bda51c20f960f2da3e7055a224194c2ff443cc5abcd8c98b96e98f6aac95cc2e

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25/01/2023, 10:42

Target

450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105.dll
Size

37KB
MD5

67965a5957a61867d661f05ae1f4773e
SHA1

f14c0a4f154dc685bb7c65b2d804a02a0fb2360d
SHA256

450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105
SHA512

c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b
SSDEEP

768:kyNq+QWR4gxSUzF08/zFlKcLdQxNld36fJPHw5g4wT1C:jNq+Qw0+JLAqf9Hw5C1C

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 604 wrote to memory of 1148	604	rundll32.exe	26
PID 604 wrote to memory of 1148	604	rundll32.exe	26
PID 604 wrote to memory of 1148	604	rundll32.exe	26
PID 604 wrote to memory of 1148	604	rundll32.exe	26
PID 604 wrote to memory of 1148	604	rundll32.exe	26
PID 604 wrote to memory of 1148	604	rundll32.exe	26
PID 604 wrote to memory of 1148	604	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:604
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105.dll,#1
  2⤵
  PID:1148

memory/1148-55-0x0000000075F81000-0x0000000075F83000-memory.dmp

Filesize
8KB

Download