bec5c7b780f99cae96a58d88c869f872fe82634b6954e0fbe808ba907ad070df

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 23:00

Target

bec5c7b780f99cae96a58d88c869f872fe82634b6954e0fbe808ba907ad070df.dll
Size

260KB
MD5

0373ed153aff9bf5f73a79e73640c08d
SHA1

848bbd243da7f25f652da2151eb809a755cb6120
SHA256

bec5c7b780f99cae96a58d88c869f872fe82634b6954e0fbe808ba907ad070df
SHA512

f73ade50a8b641bef1bcf893570fda4ab7cd92c15193602f25519dec9d156e6a1ce0e081a3fed13b5bab6a1c2cb25f24c2c3d4d668dae526461131ab03a10ebd
SSDEEP

6144:Jg2hvd8aMrLWmpABXrWFRl28owtafGsVAoSMala:JAampAbAW8arVAoSMal

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1212 wrote to memory of 1356	1212	rundll32.exe	28
PID 1212 wrote to memory of 1356	1212	rundll32.exe	28
PID 1212 wrote to memory of 1356	1212	rundll32.exe	28
PID 1212 wrote to memory of 1356	1212	rundll32.exe	28
PID 1212 wrote to memory of 1356	1212	rundll32.exe	28
PID 1212 wrote to memory of 1356	1212	rundll32.exe	28
PID 1212 wrote to memory of 1356	1212	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bec5c7b780f99cae96a58d88c869f872fe82634b6954e0fbe808ba907ad070df.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1212
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bec5c7b780f99cae96a58d88c869f872fe82634b6954e0fbe808ba907ad070df.dll,#1
  2⤵
  PID:1356

memory/1356-55-0x0000000076711000-0x0000000076713000-memory.dmp

Filesize
8KB

Download
memory/1356-56-0x0000000000220000-0x0000000000262000-memory.dmp

Filesize
264KB

Download