bddedf034c4e9ea9195314fa36f148e559611d580482bb54bf6b0cce712e2356

Analysis

max time kernel
2s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06-12-2022 01:19

Target

bddedf034c4e9ea9195314fa36f148e559611d580482bb54bf6b0cce712e2356.dll
Size

55KB
MD5

a0af9cd38a74db682ee01069a5ae687c
SHA1

ef2b6e5244c884dbf299d583b663631434b0df4e
SHA256

bddedf034c4e9ea9195314fa36f148e559611d580482bb54bf6b0cce712e2356
SHA512

c071607af09b41bb74b64f3c0bed140006ee71116f699e40eb87ae7b583440d2d03a9df59743d758e1222cef06548c2298e6b8e8576d7cda7f6451ac77dd1a59
SSDEEP

1536:agF0eiyUcbYMuZ7q439eCkS4ihxqfdY2+ePSpAdwg9mQ0:t2yFD6z39hL4ivB8S+p/0

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 1512	1792	rundll32.exe	28
PID 1792 wrote to memory of 1512	1792	rundll32.exe	28
PID 1792 wrote to memory of 1512	1792	rundll32.exe	28
PID 1792 wrote to memory of 1512	1792	rundll32.exe	28
PID 1792 wrote to memory of 1512	1792	rundll32.exe	28
PID 1792 wrote to memory of 1512	1792	rundll32.exe	28
PID 1792 wrote to memory of 1512	1792	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bddedf034c4e9ea9195314fa36f148e559611d580482bb54bf6b0cce712e2356.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bddedf034c4e9ea9195314fa36f148e559611d580482bb54bf6b0cce712e2356.dll,#1
  2⤵
  PID:1512

memory/1512-54-0x0000000000000000-mapping.dmp

Download
memory/1512-55-0x0000000074DA1000-0x0000000074DA3000-memory.dmp

Filesize
8KB

Download