bb6f22fa702c1569b32832379c4b1b5330cb1c79a1e2bbbe77ea5208315e5958

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 02:25

Target

bb6f22fa702c1569b32832379c4b1b5330cb1c79a1e2bbbe77ea5208315e5958.dll
Size

327KB
MD5

75d272be28f138c502e236e762382ae5
SHA1

b44f379b789cb548641de67319a991ea61e0bcc6
SHA256

bb6f22fa702c1569b32832379c4b1b5330cb1c79a1e2bbbe77ea5208315e5958
SHA512

cd1672abffd3a3388a09ba6e581b9b514dc49cdca697f87fa063de5d415da36f9b722f084805d8ce0da873f4463e46d90a74bb1812e9ebac5a72ceb1d195e3d9
SSDEEP

6144:EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC48Ss9Ei:EmWhND9yJz+b1FcMLmp2AT8Ssd

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2084 wrote to memory of 1916	2084	rundll32.exe	rundll32.exe
PID 2084 wrote to memory of 1916	2084	rundll32.exe	rundll32.exe
PID 2084 wrote to memory of 1916	2084	rundll32.exe	rundll32.exe
PID 2084 wrote to memory of 1916	2084	rundll32.exe	rundll32.exe
PID 2084 wrote to memory of 1916	2084	rundll32.exe	rundll32.exe
PID 2084 wrote to memory of 1916	2084	rundll32.exe	rundll32.exe
PID 2084 wrote to memory of 1916	2084	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bb6f22fa702c1569b32832379c4b1b5330cb1c79a1e2bbbe77ea5208315e5958.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2084

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bb6f22fa702c1569b32832379c4b1b5330cb1c79a1e2bbbe77ea5208315e5958.dll,#1
2⤵
PID:1916