b8e9c95040548a53e7f8089686c548feb83f3857f61e977508959e84e52107df

Analysis

max time kernel
47s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 07:53

Target

b8e9c95040548a53e7f8089686c548feb83f3857f61e977508959e84e52107df.dll
Size

5KB
MD5

99b49f026ce4dcfda46676aa4e1ebcb0
SHA1

0a1fe1a258c00fcb7c2b2cf4a12a8a8bf271f162
SHA256

b8e9c95040548a53e7f8089686c548feb83f3857f61e977508959e84e52107df
SHA512

219cc2c44ce12c444a67a4a94d941d2b92c0184ae3edc0541e622a3abe043a4e8c071658368fc41443f24366ddb12b1da3e41d419a7f57495e23bea07eb6e0c1
SSDEEP

96:REDi6iiGIaXowjJj8KE7milmQ1k6GsvvV0DB5UVMecB27xocy4BH:RE+a1eSK+VSDcmFuxmi

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 1116	1128	rundll32.exe	27
PID 1128 wrote to memory of 1116	1128	rundll32.exe	27
PID 1128 wrote to memory of 1116	1128	rundll32.exe	27
PID 1128 wrote to memory of 1116	1128	rundll32.exe	27
PID 1128 wrote to memory of 1116	1128	rundll32.exe	27
PID 1128 wrote to memory of 1116	1128	rundll32.exe	27
PID 1128 wrote to memory of 1116	1128	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b8e9c95040548a53e7f8089686c548feb83f3857f61e977508959e84e52107df.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b8e9c95040548a53e7f8089686c548feb83f3857f61e977508959e84e52107df.dll,#1
  2⤵
  PID:1116

memory/1116-55-0x0000000076961000-0x0000000076963000-memory.dmp

Filesize
8KB

Download