b2361738f900c83f75847ee8170980fe969faf9b7c3e1629bd5de130f9151b02

Analysis

max time kernel
12s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 00:36

Target

b2361738f900c83f75847ee8170980fe969faf9b7c3e1629bd5de130f9151b02.dll
Size

4KB
MD5

e232fd18981171a6cdff3db4c49de730
SHA1

441cb784934980a3e68e560cbb41a5462c0fb466
SHA256

b2361738f900c83f75847ee8170980fe969faf9b7c3e1629bd5de130f9151b02
SHA512

da45c3e2e6e7ee2ad7479117d4939ebbe0cd07c134db01d54271d5a1be7e7c1c734b180b401624c499f0048483f52307196e18ffdbf5f5998d1c5701f2405035
SSDEEP

48:a5zjMTGcITBVQVE1lctm4+8E5mDOPVESxBS/jPA5k6cif1Z6u:iT3Qu8QMVz//jzVCHf

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1156 wrote to memory of 1364	1156	rundll32.exe	28
PID 1156 wrote to memory of 1364	1156	rundll32.exe	28
PID 1156 wrote to memory of 1364	1156	rundll32.exe	28
PID 1156 wrote to memory of 1364	1156	rundll32.exe	28
PID 1156 wrote to memory of 1364	1156	rundll32.exe	28
PID 1156 wrote to memory of 1364	1156	rundll32.exe	28
PID 1156 wrote to memory of 1364	1156	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b2361738f900c83f75847ee8170980fe969faf9b7c3e1629bd5de130f9151b02.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1156
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b2361738f900c83f75847ee8170980fe969faf9b7c3e1629bd5de130f9151b02.dll,#1
  2⤵
  PID:1364

memory/1364-55-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download