bf349ffb2961f3ac9510a89c70857f96d652c1a747a8a286663aca933971ce6e

Analysis

max time kernel
41s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23/12/2022, 05:15

Target

bf349ffb2961f3ac9510a89c70857f96d652c1a747a8a286663aca933971ce6e.dll
Size

688KB
MD5

c56c894a25fd0a5ad2a665f01541f6f1
SHA1

a0cfe3a5d0bb2d2bfad547dd0bf4c75b37f80c13
SHA256

bf349ffb2961f3ac9510a89c70857f96d652c1a747a8a286663aca933971ce6e
SHA512

d1abf64bad2b55a6555e6acb42212e4d546796be6b90411f97ef388a5fed71cadff76de907180326d767496d58cfee28e253f45dce6bc9133e86f65208e1fee3
SSDEEP

12288:si8VBDpjZOCnFqUmA2AIxtkLd2+Yp+7CLh/h+yW2HrOCCvr6g1:UjifLtkY+qLBhVJYZ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1408 wrote to memory of 1156	1408	rundll32.exe	26
PID 1408 wrote to memory of 1156	1408	rundll32.exe	26
PID 1408 wrote to memory of 1156	1408	rundll32.exe	26
PID 1408 wrote to memory of 1156	1408	rundll32.exe	26
PID 1408 wrote to memory of 1156	1408	rundll32.exe	26
PID 1408 wrote to memory of 1156	1408	rundll32.exe	26
PID 1408 wrote to memory of 1156	1408	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bf349ffb2961f3ac9510a89c70857f96d652c1a747a8a286663aca933971ce6e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1408
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bf349ffb2961f3ac9510a89c70857f96d652c1a747a8a286663aca933971ce6e.dll,#1
  2⤵
  PID:1156

memory/1156-55-0x00000000750A1000-0x00000000750A3000-memory.dmp

Filesize
8KB

Download