b94872e1a7599af25caa25013fc0054e5affda6cfaef65338aa344ca2b21b4db

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
08-02-2023 18:36

Target

B94872E1A7599AF25CAA25013FC0054E5AFFDA6CFAEF6.dll
Size

2.0MB
MD5

4979beaa139791aa9d265ddc00fff0c6
SHA1

22301285c8a3e4fc0d8086f23265a2b5e7552544
SHA256

b94872e1a7599af25caa25013fc0054e5affda6cfaef65338aa344ca2b21b4db
SHA512

43267b709819f47d225013475450b879770f7e8b636be602e54bc83f57189218348027d75e0695cbb0027447ef3cacd7fb2efcc82a2f036f871e3b44c84d3341
SSDEEP

24576:Or+mhOVsJou/n4JX293Q9vGvvrIs91cYZfT4xvIwDC4k+:BmhOsouP439v6Pc+fTYO4/

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1744 wrote to memory of 2036	1744	rundll32.exe	rundll32.exe
PID 1744 wrote to memory of 2036	1744	rundll32.exe	rundll32.exe
PID 1744 wrote to memory of 2036	1744	rundll32.exe	rundll32.exe
PID 1744 wrote to memory of 2036	1744	rundll32.exe	rundll32.exe
PID 1744 wrote to memory of 2036	1744	rundll32.exe	rundll32.exe
PID 1744 wrote to memory of 2036	1744	rundll32.exe	rundll32.exe
PID 1744 wrote to memory of 2036	1744	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\B94872E1A7599AF25CAA25013FC0054E5AFFDA6CFAEF6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1744

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\B94872E1A7599AF25CAA25013FC0054E5AFFDA6CFAEF6.dll,#1
2⤵
PID:2036

memory/2036-54-0x0000000000000000-mapping.dmp

Download
memory/2036-55-0x0000000075631000-0x0000000075633000-memory.dmp

Filesize
8KB

Download
memory/2036-56-0x0000000010000000-0x000000001013E000-memory.dmp

Filesize
1.2MB

Download
memory/2036-57-0x0000000010000000-0x000000001013E000-memory.dmp

Filesize
1.2MB

Download