ba9cd1865892ff583d0777c7ce2b969de324e5a295afab5f3626a8b95ed33658

Analysis

max time kernel
40s
max time network
43s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 07:42

Target

ba9cd1865892ff583d0777c7ce2b969de324e5a295afab5f3626a8b95ed33658.dll
Size

356KB
MD5

8cd810720c65d316a65bf8701639654b
SHA1

861d0a8a9c81f573dedc7d4cd00f5f31cbf89164
SHA256

ba9cd1865892ff583d0777c7ce2b969de324e5a295afab5f3626a8b95ed33658
SHA512

59fd9649d93c054dcba5ab8075caf5e579e6f4bfa9e76015cecf93f946892b5b58a37b263ec9adb66b5c13246727bca7bb54d862ae8fe475403b314489856783
SSDEEP

6144:bVEtwQs2cAGIgXpB4COUmqoCRPOVecAGOi9BKJ163FxCnwIkhvKqP:bStkAGIgXpB460EPGO+Bg63FAuvKo

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1536	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 1536	1388	rundll32.exe	26
PID 1388 wrote to memory of 1536	1388	rundll32.exe	26
PID 1388 wrote to memory of 1536	1388	rundll32.exe	26
PID 1388 wrote to memory of 1536	1388	rundll32.exe	26
PID 1388 wrote to memory of 1536	1388	rundll32.exe	26
PID 1388 wrote to memory of 1536	1388	rundll32.exe	26
PID 1388 wrote to memory of 1536	1388	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ba9cd1865892ff583d0777c7ce2b969de324e5a295afab5f3626a8b95ed33658.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ba9cd1865892ff583d0777c7ce2b969de324e5a295afab5f3626a8b95ed33658.dll,#1
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1536

memory/1536-55-0x00000000768A1000-0x00000000768A3000-memory.dmp

Filesize
8KB

Download
memory/1536-56-0x0000000010000000-0x000000001005C000-memory.dmp

Filesize
368KB

Download
memory/1536-57-0x00000000006C1000-0x00000000006D1000-memory.dmp

Filesize
64KB

Download