7bfa9a9506443c65a32354d3a68b8c2395b036f1fd311dd61603d622ae6acb49

Analysis

max time kernel
5s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 00:04

Target

7bfa9a9506443c65a32354d3a68b8c2395b036f1fd311dd61603d622ae6acb49.dll
Size

5KB
MD5

2b1a87622faff728903d9ac64a56aa20
SHA1

fa862dc85c7da6b1baf1d39f92b66a678b890e4d
SHA256

7bfa9a9506443c65a32354d3a68b8c2395b036f1fd311dd61603d622ae6acb49
SHA512

5ebba843e6340b9478baa8825804b6f5fa2c5a12d4c3c0bf7b407d7724597ecfbfdcb228082ed5873aa174c29feab8a4b14e86c39ea5953e45ef70fe80dbe8ec
SSDEEP

48:q0aaPO8jGSLIv+Tqq7NqrhWR07iIsitl6YtDytJFgOrnsB/SsyomXrL7zLmAq:1h9jTqMMrY0OI/KYyznSMzmN

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1160 wrote to memory of 1956	1160	rundll32.exe	28
PID 1160 wrote to memory of 1956	1160	rundll32.exe	28
PID 1160 wrote to memory of 1956	1160	rundll32.exe	28
PID 1160 wrote to memory of 1956	1160	rundll32.exe	28
PID 1160 wrote to memory of 1956	1160	rundll32.exe	28
PID 1160 wrote to memory of 1956	1160	rundll32.exe	28
PID 1160 wrote to memory of 1956	1160	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7bfa9a9506443c65a32354d3a68b8c2395b036f1fd311dd61603d622ae6acb49.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7bfa9a9506443c65a32354d3a68b8c2395b036f1fd311dd61603d622ae6acb49.dll,#1
  2⤵
  PID:1956

memory/1956-55-0x0000000075B11000-0x0000000075B13000-memory.dmp

Filesize
8KB

Download