bf2f85b0fa41c19f13cedfb4513e47f4e1c3d5ba31a4d7132d881c9b22509098

Analysis

max time kernel
227s
max time network
336s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
07/12/2022, 03:49

Target

bf2f85b0fa41c19f13cedfb4513e47f4e1c3d5ba31a4d7132d881c9b22509098.dll
Size

198KB
MD5

4a92b2ae59625bea75567bf84e315726
SHA1

9a701ed1e10ff24edbc268bd3ab20b7b0722a17b
SHA256

bf2f85b0fa41c19f13cedfb4513e47f4e1c3d5ba31a4d7132d881c9b22509098
SHA512

ab93b00429d0a9ddd771df40a00b95ba1bc3f97407e14fc36c0a9e49fd21596b37e83647008850cbf836cc4566b947eda39d8533566a75d76bf1720a0d24864b
SSDEEP

3072:Dl1+XuWoafiOFKM4/0ZZF8Cuz7qtjPkbPIc7tPfCV5yiFblcW:Dz5af5UN/0ZZJuKjPNi3YPcW

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1868	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1192 wrote to memory of 1868	1192	rundll32.exe	27
PID 1192 wrote to memory of 1868	1192	rundll32.exe	27
PID 1192 wrote to memory of 1868	1192	rundll32.exe	27
PID 1192 wrote to memory of 1868	1192	rundll32.exe	27
PID 1192 wrote to memory of 1868	1192	rundll32.exe	27
PID 1192 wrote to memory of 1868	1192	rundll32.exe	27
PID 1192 wrote to memory of 1868	1192	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bf2f85b0fa41c19f13cedfb4513e47f4e1c3d5ba31a4d7132d881c9b22509098.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1192
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bf2f85b0fa41c19f13cedfb4513e47f4e1c3d5ba31a4d7132d881c9b22509098.dll,#1
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1868

memory/1868-55-0x00000000761F1000-0x00000000761F3000-memory.dmp

Filesize
8KB

Download
memory/1868-56-0x0000000000120000-0x0000000000129000-memory.dmp

Filesize
36KB

Download
memory/1868-57-0x0000000010000000-0x0000000010053000-memory.dmp

Filesize
332KB

Download