b0126514630f274a34d6fdac84e4f038212421382860227d5b92e9723eee6072

Analysis

max time kernel
28s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
04/05/2023, 21:07

Target

b0126514630f274a34d6fdac84e4f038212421382860227d5b92e9723eee6072.dll
Size

204KB
MD5

3bc74a09c6224c68d1c08565a7b18445
SHA1

a0680776fe26cb7dd22e3048a7a9df530043e326
SHA256

b0126514630f274a34d6fdac84e4f038212421382860227d5b92e9723eee6072
SHA512

9714d7282613350cf1391bf308389d0b18e62eeef51955e8f91ae0dd65003b43fde1c3543a83b2485d74205c85ab705085ddd416785c32468c128fde42d2cca2
SSDEEP

3072:7RKEHzfwQ+YAlOrIzJdLBsmsXc2k3uO15KoUThhtb1d7y:NKEHTwQ+YAZVdLeyV3uT/y

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1136 wrote to memory of 1720	1136	rundll32.exe	28
PID 1136 wrote to memory of 1720	1136	rundll32.exe	28
PID 1136 wrote to memory of 1720	1136	rundll32.exe	28
PID 1136 wrote to memory of 1720	1136	rundll32.exe	28
PID 1136 wrote to memory of 1720	1136	rundll32.exe	28
PID 1136 wrote to memory of 1720	1136	rundll32.exe	28
PID 1136 wrote to memory of 1720	1136	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b0126514630f274a34d6fdac84e4f038212421382860227d5b92e9723eee6072.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1136
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b0126514630f274a34d6fdac84e4f038212421382860227d5b92e9723eee6072.dll,#1
  2⤵
  PID:1720