bb679977c59acacdc404c2195721de2aa70c234780141e005bf91a59837fa82f

Analysis

max time kernel
58s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 14:50

Target

bb679977c59acacdc404c2195721de2aa70c234780141e005bf91a59837fa82f.dll
Size

60KB
MD5

1b988960df618c44ffdfa55d90fe9f9d
SHA1

8ab976f59685db92803299767fbf56db0a02d9d1
SHA256

bb679977c59acacdc404c2195721de2aa70c234780141e005bf91a59837fa82f
SHA512

546f7c4c6824a03772a1d56f62c358722a1688e48eaf7dd9a2bc6baa2b3624d4893919f7f4b878b6ac198f9e89f00b52770864a459c44b38b564a9cb26faf916
SSDEEP

768:0C7IqdStQUw5CITcYgUAuLTnnzNppkIW:DEqYtQZ5CIPzNHk3

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1616 wrote to memory of 524	1616	rundll32.exe	rundll32.exe
PID 1616 wrote to memory of 524	1616	rundll32.exe	rundll32.exe
PID 1616 wrote to memory of 524	1616	rundll32.exe	rundll32.exe
PID 1616 wrote to memory of 524	1616	rundll32.exe	rundll32.exe
PID 1616 wrote to memory of 524	1616	rundll32.exe	rundll32.exe
PID 1616 wrote to memory of 524	1616	rundll32.exe	rundll32.exe
PID 1616 wrote to memory of 524	1616	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bb679977c59acacdc404c2195721de2aa70c234780141e005bf91a59837fa82f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1616

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bb679977c59acacdc404c2195721de2aa70c234780141e005bf91a59837fa82f.dll,#1
2⤵
PID:524

memory/524-54-0x0000000000000000-mapping.dmp

Download
memory/524-55-0x00000000760A1000-0x00000000760A3000-memory.dmp

Filesize
8KB

Download
memory/524-56-0x0000000000110000-0x000000000011F000-memory.dmp

Filesize
60KB

Download
memory/524-57-0x0000000000110000-0x000000000011F000-memory.dmp

Filesize
60KB

Download
memory/524-58-0x0000000000110000-0x000000000011F000-memory.dmp

Filesize
60KB

Download
memory/524-59-0x0000000000120000-0x000000000012F000-memory.dmp

Filesize
60KB

Download
memory/524-60-0x0000000000120000-0x0000000000126000-memory.dmp

Filesize
24KB

Download