bf9b9c45de38d44da1b511193dec76bf21ce68676d31cbbbfaf20eb5ad51dbbf

Analysis

max time kernel
1s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 20:29

Target

bf9b9c45de38d44da1b511193dec76bf21ce68676d31cbbbfaf20eb5ad51dbbf.dll
Size

66KB
MD5

5c62d30b2aed055f39d1be16ae5e4200
SHA1

7310dd81f659cf9a95cc764591b262db87adca39
SHA256

bf9b9c45de38d44da1b511193dec76bf21ce68676d31cbbbfaf20eb5ad51dbbf
SHA512

7bf3cbe9fa2ca97979552f34c4e3a0f138d250dee6fc489af3c63ffd80b78232ad8c89fb866d6553ce4617ab22bb82af722d5115c5bec9d757ed475e80b8cb49
SSDEEP

1536:mPO6KEVbsVP0gVWZfMcocTQQQ2WJ5voRAcbQnbJHichkJFbNaI1e4h1C+nUaw:cMEVbsVcmWZhocTQQeJ5CAcSbJHi6cRk

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 2008	2036	rundll32.exe	28
PID 2036 wrote to memory of 2008	2036	rundll32.exe	28
PID 2036 wrote to memory of 2008	2036	rundll32.exe	28
PID 2036 wrote to memory of 2008	2036	rundll32.exe	28
PID 2036 wrote to memory of 2008	2036	rundll32.exe	28
PID 2036 wrote to memory of 2008	2036	rundll32.exe	28
PID 2036 wrote to memory of 2008	2036	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bf9b9c45de38d44da1b511193dec76bf21ce68676d31cbbbfaf20eb5ad51dbbf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bf9b9c45de38d44da1b511193dec76bf21ce68676d31cbbbfaf20eb5ad51dbbf.dll,#1
  2⤵
  PID:2008

memory/2008-55-0x0000000075631000-0x0000000075633000-memory.dmp

Filesize
8KB

Download