ba5e01e1a76fb32f5773212d8b6ad33fdba18205ceb174eebdba5e99b6ba7325

Analysis

max time kernel
39s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 01:15

Target

ba5e01e1a76fb32f5773212d8b6ad33fdba18205ceb174eebdba5e99b6ba7325.dll
Size

58KB
MD5

5c6cf530b06f82aa8540e3d194c55031
SHA1

4ef3236b4f47e33fc017c9cf65877338a5aebe1a
SHA256

ba5e01e1a76fb32f5773212d8b6ad33fdba18205ceb174eebdba5e99b6ba7325
SHA512

239b2f1ca015bb123b7a2f94980a24f2ac06f920c2fa3603875464648a11c96d90cdec0412956c0ec4b0b8636e31544df70aee82c05b54d2b0a9ef9780bad10d
SSDEEP

768:Gx4m7JNSll3dTG+4cxCxpfuXRigf7HsBlVShQoaHJiR+mWCdSdMrj3J76ihj9pIc:Bm1NGJVG3cIgrleXqSdcJ762px53

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 2012	1516	rundll32.exe	27
PID 1516 wrote to memory of 2012	1516	rundll32.exe	27
PID 1516 wrote to memory of 2012	1516	rundll32.exe	27
PID 1516 wrote to memory of 2012	1516	rundll32.exe	27
PID 1516 wrote to memory of 2012	1516	rundll32.exe	27
PID 1516 wrote to memory of 2012	1516	rundll32.exe	27
PID 1516 wrote to memory of 2012	1516	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ba5e01e1a76fb32f5773212d8b6ad33fdba18205ceb174eebdba5e99b6ba7325.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ba5e01e1a76fb32f5773212d8b6ad33fdba18205ceb174eebdba5e99b6ba7325.dll,#1
  2⤵
  PID:2012

memory/2012-55-0x0000000075841000-0x0000000075843000-memory.dmp

Filesize
8KB

Download