76bdaabf8949388778890ee3fc08b5a70a2b537ebdfa18070fe599e7529b7f1c

Analysis

max time kernel
45s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
14/01/2023, 01:47

Target

76bdaabf8949388778890ee3fc08b5a70a2b537ebdfa18070fe599e7529b7f1c.dll
Size

220KB
MD5

46417ad0fc33783c298b7441aced2c1a
SHA1

05404bf3c5f4f534b1139e921891f46842c14286
SHA256

76bdaabf8949388778890ee3fc08b5a70a2b537ebdfa18070fe599e7529b7f1c
SHA512

59ea726334a61ce34fdfee0da930b282fefbfbd7fe0ccc289fb633ad7897fbf89a7a277e0ad187d9443bd08436d36343f7e57f484ff3d10ec645e228cad7cf94
SSDEEP

3072:Xsc7rew/Ceylv8MTVy1D9/2tQwG4n4x4mCLhK6Z6U43xDdXsAg0FujVAJkRK1lrT:XrPe86g9/rC4xpCt48AOpAJUk3j

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 1016	1972	rundll32.exe	28
PID 1972 wrote to memory of 1016	1972	rundll32.exe	28
PID 1972 wrote to memory of 1016	1972	rundll32.exe	28
PID 1972 wrote to memory of 1016	1972	rundll32.exe	28
PID 1972 wrote to memory of 1016	1972	rundll32.exe	28
PID 1972 wrote to memory of 1016	1972	rundll32.exe	28
PID 1972 wrote to memory of 1016	1972	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\76bdaabf8949388778890ee3fc08b5a70a2b537ebdfa18070fe599e7529b7f1c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\76bdaabf8949388778890ee3fc08b5a70a2b537ebdfa18070fe599e7529b7f1c.dll,#1
  2⤵
  PID:1016

memory/1016-55-0x00000000756B1000-0x00000000756B3000-memory.dmp

Filesize
8KB

Download