b0e8107f94d7cc9cbba5c21ecac8023243b3c79ccabb3979446d98b9b920e11a

Analysis

max time kernel
3s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 15:11

Target

b0e8107f94d7cc9cbba5c21ecac8023243b3c79ccabb3979446d98b9b920e11a.dll
Size

57KB
MD5

af35e20d573172559a69e3dff30a6d81
SHA1

d90b49abebfc83e8c516e8fb06659ba39065f1e9
SHA256

b0e8107f94d7cc9cbba5c21ecac8023243b3c79ccabb3979446d98b9b920e11a
SHA512

aafad7bde4075a874a65bb97d6387d6597896772cee21a9731c9af7203ef99ec45d74f8d741e37ffbb7effde4361689586988bc84f911097f622c5b866b725fd
SSDEEP

1536:0NIKD84YU6EMyDcqiZZZNihyISFIR6/JP+3CT:Jq84YU6ErtGNEKIpCT

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 1360	1416	rundll32.exe	28
PID 1416 wrote to memory of 1360	1416	rundll32.exe	28
PID 1416 wrote to memory of 1360	1416	rundll32.exe	28
PID 1416 wrote to memory of 1360	1416	rundll32.exe	28
PID 1416 wrote to memory of 1360	1416	rundll32.exe	28
PID 1416 wrote to memory of 1360	1416	rundll32.exe	28
PID 1416 wrote to memory of 1360	1416	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b0e8107f94d7cc9cbba5c21ecac8023243b3c79ccabb3979446d98b9b920e11a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b0e8107f94d7cc9cbba5c21ecac8023243b3c79ccabb3979446d98b9b920e11a.dll,#1
  2⤵
  PID:1360

memory/1360-55-0x0000000075F01000-0x0000000075F03000-memory.dmp

Filesize
8KB

Download