ba1872adf6fd8f02c918a3cf318623127196d38b8a9c894b53ac569584297bf7

Analysis

max time kernel
39s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 11:49

Target

ba1872adf6fd8f02c918a3cf318623127196d38b8a9c894b53ac569584297bf7.dll
Size

6KB
MD5

bdcc0fafe5122451e12761fd9fee1190
SHA1

ead01e41ce4ec6d2db01a3ef26bf1680191bc310
SHA256

ba1872adf6fd8f02c918a3cf318623127196d38b8a9c894b53ac569584297bf7
SHA512

4e10d7be6d2b0d8e701906c57792ed1a54e42036e87880238923482722e026a301e1a1c0c0238b515ae4cfd156b9558fbd9494afa76f0fff1071164b4157fc22
SSDEEP

96:PIV9yIjhsZrg0j6I/AhWNi6iEzgMgeZfZXgFGEZ:PyIIjWXGhq

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1236 wrote to memory of 1412	1236	rundll32.exe	27
PID 1236 wrote to memory of 1412	1236	rundll32.exe	27
PID 1236 wrote to memory of 1412	1236	rundll32.exe	27
PID 1236 wrote to memory of 1412	1236	rundll32.exe	27
PID 1236 wrote to memory of 1412	1236	rundll32.exe	27
PID 1236 wrote to memory of 1412	1236	rundll32.exe	27
PID 1236 wrote to memory of 1412	1236	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ba1872adf6fd8f02c918a3cf318623127196d38b8a9c894b53ac569584297bf7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1236
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ba1872adf6fd8f02c918a3cf318623127196d38b8a9c894b53ac569584297bf7.dll,#1
  2⤵
  PID:1412

memory/1412-55-0x0000000075141000-0x0000000075143000-memory.dmp

Filesize
8KB

Download