b1f28513a51f152a427c0790ecac2b18f3b9e6f2b2b84019d5f4b5f3c1209a73

Analysis

max time kernel
15s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 12:12

Target

b1f28513a51f152a427c0790ecac2b18f3b9e6f2b2b84019d5f4b5f3c1209a73.dll
Size

245KB
MD5

0c51354a3911a774947bcc3e0a4d92e7
SHA1

eb6e9d79e5b8ad46e0f43f9c50a7c9872c1fbf24
SHA256

b1f28513a51f152a427c0790ecac2b18f3b9e6f2b2b84019d5f4b5f3c1209a73
SHA512

27e263e9232ff0f4062c839483bb59fbea13908233caceb498ff63b91f7062e9c40cebb6aa86fd7c29b078b2a5242e2257b3292db7796dee8d4d4faf6afbc2a8
SSDEEP

3072:SnMoFkOKCg3CXmSSZlzgeBTg4vRPo5NNFs+XNtUU/chmcFTulOVq5pNZfpcvfn2k:SMJOWK4l0wqOVq1Z2vuYWmdXOG

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1156 wrote to memory of 1364	1156	rundll32.exe	28
PID 1156 wrote to memory of 1364	1156	rundll32.exe	28
PID 1156 wrote to memory of 1364	1156	rundll32.exe	28
PID 1156 wrote to memory of 1364	1156	rundll32.exe	28
PID 1156 wrote to memory of 1364	1156	rundll32.exe	28
PID 1156 wrote to memory of 1364	1156	rundll32.exe	28
PID 1156 wrote to memory of 1364	1156	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b1f28513a51f152a427c0790ecac2b18f3b9e6f2b2b84019d5f4b5f3c1209a73.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1156
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b1f28513a51f152a427c0790ecac2b18f3b9e6f2b2b84019d5f4b5f3c1209a73.dll,#1
  2⤵
  PID:1364

memory/1364-55-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download
memory/1364-56-0x0000000010000000-0x0000000010042000-memory.dmp

Filesize
264KB

Download