bbe61392bb367795458d1817e8b2c52c1c61632797babe981a2f0a3b57c30f60

Analysis

max time kernel
31s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
01-04-2023 18:55

Target

bbe61392bb367795458d1817e8b2c52c1c61632797babe981a2f0a3b57c30f60.dll
Size

292KB
MD5

58967081a2a9d40e185836e73d3e7c10
SHA1

5697833b058d9cb82a2ae53063214e330d757946
SHA256

bbe61392bb367795458d1817e8b2c52c1c61632797babe981a2f0a3b57c30f60
SHA512

2fa31352d9b23febb0f6c63f3240a2c9671a141c3349f6c14176cd407f54dcbbe8ca60cbf40060a223912c36bc18b692fef97251540784e4cf2381f0e226e36c
SSDEEP

6144:YJYXyRMIlatja4WZJF3kjrdCDAm+S+PnRzZFiMTrQUsscH2CeYFztd:YJxRlPzZQr2AmPsMYesVCeYFz3

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 628 wrote to memory of 1712	628	rundll32.exe	rundll32.exe
PID 628 wrote to memory of 1712	628	rundll32.exe	rundll32.exe
PID 628 wrote to memory of 1712	628	rundll32.exe	rundll32.exe
PID 628 wrote to memory of 1712	628	rundll32.exe	rundll32.exe
PID 628 wrote to memory of 1712	628	rundll32.exe	rundll32.exe
PID 628 wrote to memory of 1712	628	rundll32.exe	rundll32.exe
PID 628 wrote to memory of 1712	628	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bbe61392bb367795458d1817e8b2c52c1c61632797babe981a2f0a3b57c30f60.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:628
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bbe61392bb367795458d1817e8b2c52c1c61632797babe981a2f0a3b57c30f60.dll,#1
  2⤵
  PID:1712

memory/1712-54-0x0000000001B70000-0x0000000001C32000-memory.dmp

Filesize
776KB

Download
memory/1712-55-0x0000000001B70000-0x0000000001C31000-memory.dmp

Filesize
772KB

Download