b8e5f835376a8729e5b65de994690800df8b5530c50befba0a5fec80a5c7ae20

Analysis

max time kernel
39s
max time network
43s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 14:31

Target

b8e5f835376a8729e5b65de994690800df8b5530c50befba0a5fec80a5c7ae20.dll
Size

105KB
MD5

edf51f31a003a410b3ca9ce9b59dd6da
SHA1

c1bd2b4df928e3a9237c29df44371cec17532a62
SHA256

b8e5f835376a8729e5b65de994690800df8b5530c50befba0a5fec80a5c7ae20
SHA512

e52fb761645126e89a373595ef90eedbf8a277952e4e8b5663553526913c880891b107a5d2b888bed5625481830b139cd84d8bf9414c5689b9c042583488230e
SSDEEP

3072:f/+7/X74Y0m4qaO9B7XUThcjoeBALkkawPGKHAxWBQdZNcZo:f/+7vupqNZjDBAoB6GKgxWWi

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 1704	1928	rundll32.exe	26
PID 1928 wrote to memory of 1704	1928	rundll32.exe	26
PID 1928 wrote to memory of 1704	1928	rundll32.exe	26
PID 1928 wrote to memory of 1704	1928	rundll32.exe	26
PID 1928 wrote to memory of 1704	1928	rundll32.exe	26
PID 1928 wrote to memory of 1704	1928	rundll32.exe	26
PID 1928 wrote to memory of 1704	1928	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b8e5f835376a8729e5b65de994690800df8b5530c50befba0a5fec80a5c7ae20.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b8e5f835376a8729e5b65de994690800df8b5530c50befba0a5fec80a5c7ae20.dll,#1
  2⤵
  PID:1704

memory/1704-55-0x00000000762B1000-0x00000000762B3000-memory.dmp

Filesize
8KB

Download
memory/1704-56-0x0000000000160000-0x000000000016F000-memory.dmp

Filesize
60KB

Download
memory/1704-57-0x00000000001C0000-0x00000000001DD000-memory.dmp

Filesize
116KB

Download