bf5e3d2c2249feed535d216240a386a61dd2f745a7fef66709ca3a4e4b604c6d

Analysis

max time kernel
31s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 14:44

Target

bf5e3d2c2249feed535d216240a386a61dd2f745a7fef66709ca3a4e4b604c6d.dll
Size

2.3MB
MD5

079201873de4dce352e0b80718e6da31
SHA1

a44489900f7d217da23b381897f61b9eeec5159d
SHA256

bf5e3d2c2249feed535d216240a386a61dd2f745a7fef66709ca3a4e4b604c6d
SHA512

56770e6da843bc2163453a069e896a140618fc8cb97e18e657578df04bc1ad65093e40aa896c48d85904116a4f39ec5752a507ad43584cc5e764dc43e2571270
SSDEEP

24576:x0TNUw0V/hyW/yD1FcBDVPokvpWTMYBgO9Zf0TNUw0VqvqVkYT9wa2EXEEB:qTNsV5s1FS5Re+OgTNsVLk8Ka7

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 944 wrote to memory of 864	944	rundll32.exe	28
PID 944 wrote to memory of 864	944	rundll32.exe	28
PID 944 wrote to memory of 864	944	rundll32.exe	28
PID 944 wrote to memory of 864	944	rundll32.exe	28
PID 944 wrote to memory of 864	944	rundll32.exe	28
PID 944 wrote to memory of 864	944	rundll32.exe	28
PID 944 wrote to memory of 864	944	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bf5e3d2c2249feed535d216240a386a61dd2f745a7fef66709ca3a4e4b604c6d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:944
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bf5e3d2c2249feed535d216240a386a61dd2f745a7fef66709ca3a4e4b604c6d.dll,#1
  2⤵
  PID:864

memory/864-55-0x0000000075B61000-0x0000000075B63000-memory.dmp

Filesize
8KB

Download