bf559b7ff4cf7cbe9e43b97b8e250304952cc530e22efd723d0d77afd48a9b3e

Analysis

max time kernel
43s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 07:08

Target

bf559b7ff4cf7cbe9e43b97b8e250304952cc530e22efd723d0d77afd48a9b3e.dll
Size

25KB
MD5

63909d2b3b4248538df414a4afea7fb0
SHA1

aaa12db599d60220da536524fb6a2aa4b5d176d0
SHA256

bf559b7ff4cf7cbe9e43b97b8e250304952cc530e22efd723d0d77afd48a9b3e
SHA512

07a2d711ad41ee716f58f6892d343d5f03a236579f686fffaed69cbdccb6177187f4e98ed5439250543cedd9138759a29b3056b9d9f3af020f9158d0bf94499b
SSDEEP

384:nGhNz35E7duta+fGGq77nRrFglQWY6awzjRcfE:nGfz3u7duta+Rq7lrFGQZ6hzjReE

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 1160	1712	rundll32.exe	27
PID 1712 wrote to memory of 1160	1712	rundll32.exe	27
PID 1712 wrote to memory of 1160	1712	rundll32.exe	27
PID 1712 wrote to memory of 1160	1712	rundll32.exe	27
PID 1712 wrote to memory of 1160	1712	rundll32.exe	27
PID 1712 wrote to memory of 1160	1712	rundll32.exe	27
PID 1712 wrote to memory of 1160	1712	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bf559b7ff4cf7cbe9e43b97b8e250304952cc530e22efd723d0d77afd48a9b3e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bf559b7ff4cf7cbe9e43b97b8e250304952cc530e22efd723d0d77afd48a9b3e.dll,#1
  2⤵
  PID:1160

memory/1160-55-0x00000000765B1000-0x00000000765B3000-memory.dmp

Filesize
8KB

Download