b4a61c8d752debdedc8f2719b42a7d1d201aa095a51f9c4d14c79ed80233e600

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 08:21

Target

b4a61c8d752debdedc8f2719b42a7d1d201aa095a51f9c4d14c79ed80233e600.dll
Size

318KB
MD5

49a049a7a084c79665de493d78a3cb8c
SHA1

eb38ea5bff4f87b8d9684681cdc78e4389d7dfd6
SHA256

b4a61c8d752debdedc8f2719b42a7d1d201aa095a51f9c4d14c79ed80233e600
SHA512

8cecf8a34b4b97bcd0b3035d7de62d2219c47876ad1e9e32a52e504bf75f18f704cdbd2403a358894fe9ab957477f2e8517569bc13e52e73ec413f50106a6b94
SSDEEP

6144:NcEU6QCGaFLdndWSZFXDMAgkKXwt8HcyIYdBJ0kI+pHF5NNyEfqvPDmFx2HOoDfQ:9vXPZPZpMHipyI+5ZHvEXo2u44

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 2016	1672	rundll32.exe	27
PID 1672 wrote to memory of 2016	1672	rundll32.exe	27
PID 1672 wrote to memory of 2016	1672	rundll32.exe	27
PID 1672 wrote to memory of 2016	1672	rundll32.exe	27
PID 1672 wrote to memory of 2016	1672	rundll32.exe	27
PID 1672 wrote to memory of 2016	1672	rundll32.exe	27
PID 1672 wrote to memory of 2016	1672	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b4a61c8d752debdedc8f2719b42a7d1d201aa095a51f9c4d14c79ed80233e600.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b4a61c8d752debdedc8f2719b42a7d1d201aa095a51f9c4d14c79ed80233e600.dll,#1
  2⤵
  PID:2016

memory/2016-55-0x0000000075201000-0x0000000075203000-memory.dmp

Filesize
8KB

Download