c931b1825c3a09f15cb4b2357b7a90ec3b13a19252f8520819ddd9b325387894

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
04/05/2023, 03:27

Target

SecuriteInfo.com.Variant.Barys.320444.11967.28102.dll
Size

17KB
MD5

d2cd6dae38d93539821d4c6e8d2afbf3
SHA1

1ffc3d1846c42367f3f9b0ba498ee192489e0bd9
SHA256

c931b1825c3a09f15cb4b2357b7a90ec3b13a19252f8520819ddd9b325387894
SHA512

d5d49b2c93914f09bb3684186d48ebefd6eda17f4420ac403f485bfff150bf18487eb6cf3feaa131e2e0f3ccb9a6f93ff7add88cf72abac2fdc9cdf233834ac3
SSDEEP

192:r8WVrjkw+3GhTla1LiOOrsQcRga/6UhCJaECeZGaJewLRsutxFBXgGWcUO9FftxD:4WV8w8e6Mr8zhCUEDsuPXjWm9FfXSE

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 1704	1264	rundll32.exe	28
PID 1264 wrote to memory of 1704	1264	rundll32.exe	28
PID 1264 wrote to memory of 1704	1264	rundll32.exe	28
PID 1264 wrote to memory of 1704	1264	rundll32.exe	28
PID 1264 wrote to memory of 1704	1264	rundll32.exe	28
PID 1264 wrote to memory of 1704	1264	rundll32.exe	28
PID 1264 wrote to memory of 1704	1264	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Barys.320444.11967.28102.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Barys.320444.11967.28102.dll,#1
  2⤵
  PID:1704