b651e33acc70aee4b36e0589852bd2c92250f9e5c6d20a8367b6c6a56fc7928c

Analysis

max time kernel
42s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 01:19

Target

b651e33acc70aee4b36e0589852bd2c92250f9e5c6d20a8367b6c6a56fc7928c.dll
Size

31KB
MD5

cb2699993ae8998124ba4248190f4380
SHA1

ccb7bbc5a80256b614a311a9ddc1afd7efd622ee
SHA256

b651e33acc70aee4b36e0589852bd2c92250f9e5c6d20a8367b6c6a56fc7928c
SHA512

4b780581998196d9ce27508a460676b8e72728e16fb3e7edfa77653980785af11f3fdebdc68b242a4bc4f0432059cae64fc960e3f00a6257f8eb5bd668ea68eb
SSDEEP

768:GfJWWx+m1wCoAhauhAA7JY3HDqgl0Gp/BBQARQkPpc:/Wn3eqgl0QBBQAR

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 896 wrote to memory of 1952	896	rundll32.exe	28
PID 896 wrote to memory of 1952	896	rundll32.exe	28
PID 896 wrote to memory of 1952	896	rundll32.exe	28
PID 896 wrote to memory of 1952	896	rundll32.exe	28
PID 896 wrote to memory of 1952	896	rundll32.exe	28
PID 896 wrote to memory of 1952	896	rundll32.exe	28
PID 896 wrote to memory of 1952	896	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b651e33acc70aee4b36e0589852bd2c92250f9e5c6d20a8367b6c6a56fc7928c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:896
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b651e33acc70aee4b36e0589852bd2c92250f9e5c6d20a8367b6c6a56fc7928c.dll,#1
  2⤵
  PID:1952

memory/1952-55-0x0000000075E31000-0x0000000075E33000-memory.dmp

Filesize
8KB

Download