b114c67a671f1c9969fb0c86b081f5f09ca9448d567db20f46da69e678ce4c9b

Analysis

max time kernel
9s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 15:10

Target

b114c67a671f1c9969fb0c86b081f5f09ca9448d567db20f46da69e678ce4c9b.dll
Size

25KB
MD5

fb88cfe384063f0c0e2ee8388be1abc8
SHA1

463fe46f09e3a19674a4ddca2d3c2c4c563f52d3
SHA256

b114c67a671f1c9969fb0c86b081f5f09ca9448d567db20f46da69e678ce4c9b
SHA512

d6f622825c03e53fc762df7f551dbec1d3fc1b68ae661bb23bfe128ae83a9d21fb1ca526da9e2900810ec8c5eada0ad3d6420ba8b45baff4d04f348d57f8b439
SSDEEP

384:3hGOg48MrU3pdAKg0NXAlSIfQGuVa9043NYElIBMMNT3X96hZRY8i8LwsHQC:RJHmbNfIfQpsTlo96hTxLhl

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 840	1200	rundll32.exe	28
PID 1200 wrote to memory of 840	1200	rundll32.exe	28
PID 1200 wrote to memory of 840	1200	rundll32.exe	28
PID 1200 wrote to memory of 840	1200	rundll32.exe	28
PID 1200 wrote to memory of 840	1200	rundll32.exe	28
PID 1200 wrote to memory of 840	1200	rundll32.exe	28
PID 1200 wrote to memory of 840	1200	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b114c67a671f1c9969fb0c86b081f5f09ca9448d567db20f46da69e678ce4c9b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b114c67a671f1c9969fb0c86b081f5f09ca9448d567db20f46da69e678ce4c9b.dll,#1
  2⤵
  PID:840

memory/840-55-0x0000000076041000-0x0000000076043000-memory.dmp

Filesize
8KB

Download
memory/840-56-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download