bf8da6bd2339da293c05daf9d3cdeca4b012ac75d458192657a1e7153b51330f

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 02:54

Target

bf8da6bd2339da293c05daf9d3cdeca4b012ac75d458192657a1e7153b51330f.dll
Size

81KB
MD5

fd3494b485a316732992cc1eda36b70b
SHA1

64ab228ab85df3aed23fe7372febc03841833e53
SHA256

bf8da6bd2339da293c05daf9d3cdeca4b012ac75d458192657a1e7153b51330f
SHA512

b12484f6975a18a46fb2b3789b14e3502fe149e00d68269988a14ab8462a2450aa19df37d8e92a2eb31a36e88ddebb3ea7bddfa65a54afc76fb12dcf8af0c9b3
SSDEEP

1536:6ByXv7uWGEqXZKXTadSp7Lxw9zzBPw+NASUSFOj8sWHcdF6+eXq8Wb:bv4JKXTx71wnArSsXFpeXq8Wb

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 1352	2200	rundll32.exe	28
PID 2200 wrote to memory of 1352	2200	rundll32.exe	28
PID 2200 wrote to memory of 1352	2200	rundll32.exe	28
PID 2200 wrote to memory of 1352	2200	rundll32.exe	28
PID 2200 wrote to memory of 1352	2200	rundll32.exe	28
PID 2200 wrote to memory of 1352	2200	rundll32.exe	28
PID 2200 wrote to memory of 1352	2200	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bf8da6bd2339da293c05daf9d3cdeca4b012ac75d458192657a1e7153b51330f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bf8da6bd2339da293c05daf9d3cdeca4b012ac75d458192657a1e7153b51330f.dll,#1
  2⤵
  PID:1352