b17077f3e2bfc97fdca6c37668332d0c9ca3f7fa62487cf00196d3c8576e128c

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 02:05 UTC

Target

b17077f3e2bfc97fdca6c37668332d0c9ca3f7fa62487cf00196d3c8576e128c.dll
Size

33KB
MD5

3cad5bdfbe611b559932ccc91c12f1bb
SHA1

f7a4bfef88b5baa26863e5fd942188101aa039a8
SHA256

b17077f3e2bfc97fdca6c37668332d0c9ca3f7fa62487cf00196d3c8576e128c
SHA512

5e6f1e33556e0c0267811d2747df44cbc1cf8161e2e32864f7c22d9c1ad04e9fa59b3562193634c46d2dc10358f2d959661fcdabb71731765a4f0f15bbae2a73
SSDEEP

768:0X5wlHbBOm1e6Y31CLlr7yV7/1GVF5lhCDmERaAG:m5QNOm16FChS7/1GVFL8aERHG

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 1968	2020	rundll32.exe	28
PID 2020 wrote to memory of 1968	2020	rundll32.exe	28
PID 2020 wrote to memory of 1968	2020	rundll32.exe	28
PID 2020 wrote to memory of 1968	2020	rundll32.exe	28
PID 2020 wrote to memory of 1968	2020	rundll32.exe	28
PID 2020 wrote to memory of 1968	2020	rundll32.exe	28
PID 2020 wrote to memory of 1968	2020	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b17077f3e2bfc97fdca6c37668332d0c9ca3f7fa62487cf00196d3c8576e128c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b17077f3e2bfc97fdca6c37668332d0c9ca3f7fa62487cf00196d3c8576e128c.dll,#1
  2⤵
  PID:1968

memory/1968-55-0x00000000756B1000-0x00000000756B3000-memory.dmp

Filesize
8KB

Download