bdc076a73996970406fe901ebe4df6e729f21bf0340888c5fa06e6e9929794ef

Analysis

max time kernel
16s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 14:08

Target

bdc076a73996970406fe901ebe4df6e729f21bf0340888c5fa06e6e9929794ef.dll
Size

33KB
MD5

93eafe351c362bc6c07ae97099cb4eb7
SHA1

afb42e00c010ba80fd833a304f3581d0dea649c8
SHA256

bdc076a73996970406fe901ebe4df6e729f21bf0340888c5fa06e6e9929794ef
SHA512

8e0423a0a950355f5e2739fd0a1cb57478e7f689a82dee769bfdf7842bede7b5a0eaa49dae997cd17fdc3bedd6084eaf0386e64ebdab9174fad3bc075e4bbbc1
SSDEEP

768:IH1vfnnoOPQmIPWW75khYOj6eqOq6FR7Sue:IVvPn0mI575khYOjoSR7Sue

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 1048	1952	rundll32.exe	28
PID 1952 wrote to memory of 1048	1952	rundll32.exe	28
PID 1952 wrote to memory of 1048	1952	rundll32.exe	28
PID 1952 wrote to memory of 1048	1952	rundll32.exe	28
PID 1952 wrote to memory of 1048	1952	rundll32.exe	28
PID 1952 wrote to memory of 1048	1952	rundll32.exe	28
PID 1952 wrote to memory of 1048	1952	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bdc076a73996970406fe901ebe4df6e729f21bf0340888c5fa06e6e9929794ef.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bdc076a73996970406fe901ebe4df6e729f21bf0340888c5fa06e6e9929794ef.dll,#1
  2⤵
  PID:1048

memory/1048-55-0x00000000753C1000-0x00000000753C3000-memory.dmp

Filesize
8KB

Download