bafdaab84e88bea5a7378236bb29f20d583f36a8d0c24c563cf93fc8935b67d0

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
17-03-2023 22:00

Target

bafdaab84e88bea5a7378236bb29f20d583f36a8d0c24c563cf93fc8935b67d0.dll
Size

2.1MB
MD5

a944c319f7383377cefe68709056c674
SHA1

a31b7731fcf0df14401531c8295205a2d20c25e7
SHA256

bafdaab84e88bea5a7378236bb29f20d583f36a8d0c24c563cf93fc8935b67d0
SHA512

b8b81cf3bcf8a43cea3ee1f6f0e9fa4359fc2fa1b20c848b2ff1b1b7b288f299a722ef77cb7eea8cf9caf4e84208ed12d5fb965d1a3d77fc079d0cbed0bd0dc3
SSDEEP

49152:vqf/yWkEgFoSWNjt4Onwti9ipF41Ltz1VKGdirw9DSjcTiVAKQNMwN:if6XEgFSIpAtXKNjZQdN

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 1564	1488	rundll32.exe	27
PID 1488 wrote to memory of 1564	1488	rundll32.exe	27
PID 1488 wrote to memory of 1564	1488	rundll32.exe	27
PID 1488 wrote to memory of 1564	1488	rundll32.exe	27
PID 1488 wrote to memory of 1564	1488	rundll32.exe	27
PID 1488 wrote to memory of 1564	1488	rundll32.exe	27
PID 1488 wrote to memory of 1564	1488	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bafdaab84e88bea5a7378236bb29f20d583f36a8d0c24c563cf93fc8935b67d0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bafdaab84e88bea5a7378236bb29f20d583f36a8d0c24c563cf93fc8935b67d0.dll,#1
  2⤵
  PID:1564

memory/1564-54-0x0000000042200000-0x000000004284D000-memory.dmp

Filesize
6.3MB

Download
memory/1564-55-0x0000000042200000-0x000000004284D000-memory.dmp

Filesize
6.3MB

Download