bfab4c1c7112e25e6724e1ec7e529de8695073ec62281846efd1af0715b8487e

Analysis

max time kernel
24s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 13:59

Target

bfab4c1c7112e25e6724e1ec7e529de8695073ec62281846efd1af0715b8487e.dll
Size

387KB
MD5

dcafc00ceac512f819cc01301cb999ab
SHA1

0c4ee239fd09e092a99e12a5e653c1ff5ad541be
SHA256

bfab4c1c7112e25e6724e1ec7e529de8695073ec62281846efd1af0715b8487e
SHA512

c581f34833d0497a6ccb26d7aa84ee1a6b4c9a08038e339ea55b1efe3335e0a43b15c8ee3cc897aa67b5520c9d28bb1dda13ac8c0d8180046f5cd23edbcb21ca
SSDEEP

6144:tSVkWfvHzYGn4bscJM1QJQgBG34NhPiwoDbHWxGg5CwpX0q0Ag07S:tTWfvTXn4bsfyJc3k2b2xGg5CmJ0AP7

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1284 wrote to memory of 280	1284	rundll32.exe	28
PID 1284 wrote to memory of 280	1284	rundll32.exe	28
PID 1284 wrote to memory of 280	1284	rundll32.exe	28
PID 1284 wrote to memory of 280	1284	rundll32.exe	28
PID 1284 wrote to memory of 280	1284	rundll32.exe	28
PID 1284 wrote to memory of 280	1284	rundll32.exe	28
PID 1284 wrote to memory of 280	1284	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bfab4c1c7112e25e6724e1ec7e529de8695073ec62281846efd1af0715b8487e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1284
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bfab4c1c7112e25e6724e1ec7e529de8695073ec62281846efd1af0715b8487e.dll,#1
  2⤵
  PID:280

memory/280-55-0x0000000075A11000-0x0000000075A13000-memory.dmp

Filesize
8KB

Download