bf7db9377fd34dddeebfd34ed40b51da70a13cf92d3656074bb074d038c62d7f

Analysis

max time kernel
31s
max time network
32s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 13:23

Target

bf7db9377fd34dddeebfd34ed40b51da70a13cf92d3656074bb074d038c62d7f.dll
Size

148KB
MD5

b31f002c1bb3c7a24a4f8fc8c2ae8834
SHA1

9811799323d465568848e9915d25f37efe2d5c3f
SHA256

bf7db9377fd34dddeebfd34ed40b51da70a13cf92d3656074bb074d038c62d7f
SHA512

64e0bedd8a5e2c7bfc97abc7f3e53e491e0d88565a8777f6f6084d903c682e156a8e61e6b36c04e704aa46101e0051b0d08cab9471b952d741ed2912b5a795f8
SSDEEP

3072:fH71oVlpRk1EAnxMJ8jYFkFXs9Wafwiq:v7iSEuI8gkFXhao1

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1236 wrote to memory of 1204	1236	rundll32.exe	28
PID 1236 wrote to memory of 1204	1236	rundll32.exe	28
PID 1236 wrote to memory of 1204	1236	rundll32.exe	28
PID 1236 wrote to memory of 1204	1236	rundll32.exe	28
PID 1236 wrote to memory of 1204	1236	rundll32.exe	28
PID 1236 wrote to memory of 1204	1236	rundll32.exe	28
PID 1236 wrote to memory of 1204	1236	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bf7db9377fd34dddeebfd34ed40b51da70a13cf92d3656074bb074d038c62d7f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1236
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bf7db9377fd34dddeebfd34ed40b51da70a13cf92d3656074bb074d038c62d7f.dll,#1
  2⤵
  PID:1204

memory/1204-55-0x0000000075991000-0x0000000075993000-memory.dmp

Filesize
8KB

Download