b6b68e13b0c5b9ea37f0c12261b856e8d65cdef3b32b03d09cbcb99704729fbb

Analysis

max time kernel
39s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 06:47

Target

b6b68e13b0c5b9ea37f0c12261b856e8d65cdef3b32b03d09cbcb99704729fbb.dll
Size

139KB
MD5

e550b7799969c988e1922999f220bc87
SHA1

c04dd205ca554361332d8bcfa221cbd2b247a255
SHA256

b6b68e13b0c5b9ea37f0c12261b856e8d65cdef3b32b03d09cbcb99704729fbb
SHA512

f53264c4776438c3b7b82081725cb97c49b71925fa5d399c52fa831c28508e3ba34c9bf6e738ebe3549a981697f86ff253fce61c202053e7691baf9968816927
SSDEEP

3072:1bDv3BhbrRd0jm/iLVO8WplhNn3HxAF74xMll0Dt:1bDJl0jm/inMDXxAZ1EDt

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 1472	2020	rundll32.exe	26
PID 2020 wrote to memory of 1472	2020	rundll32.exe	26
PID 2020 wrote to memory of 1472	2020	rundll32.exe	26
PID 2020 wrote to memory of 1472	2020	rundll32.exe	26
PID 2020 wrote to memory of 1472	2020	rundll32.exe	26
PID 2020 wrote to memory of 1472	2020	rundll32.exe	26
PID 2020 wrote to memory of 1472	2020	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b6b68e13b0c5b9ea37f0c12261b856e8d65cdef3b32b03d09cbcb99704729fbb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b6b68e13b0c5b9ea37f0c12261b856e8d65cdef3b32b03d09cbcb99704729fbb.dll,#1
  2⤵
  PID:1472

memory/1472-55-0x0000000075451000-0x0000000075453000-memory.dmp

Filesize
8KB

Download