7f67d218c75dba087b07ecbf832daaa49d31a71521f243d4df7f44c1cd7b6644

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 11:43

Target
BLL.dll
Size 109KB
Sample240527-nv2f6abb33
SHA256 7f67d218c75dba087b07ecbf832daaa49d31a71521f243d4df7f44c1cd7b6644
MD5 6105934cd6c2a4e1e80d3c401a142f1c
SHA1 9b151fa9d92835d41bc6bb0eaa621259b1010888
SHA512 64550724c723d59d0da9fd3c4ae7b52aa7728b88edf0ad2d77b3915632b061e2f3fbf32249316bc836eff419439553857cc8558389c407ee06f80d6830d9c183
SSDEEP 1536:16hu3IWz7r3m0y7ks4YkXqcvXClxRKI04AAtYqfYQHrK7j:wW3rW0RYhWXC908YqwH
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 1752	2208	rundll32.exe	28
PID 2208 wrote to memory of 1752	2208	rundll32.exe	28
PID 2208 wrote to memory of 1752	2208	rundll32.exe	28
PID 2208 wrote to memory of 1752	2208	rundll32.exe	28
PID 2208 wrote to memory of 1752	2208	rundll32.exe	28
PID 2208 wrote to memory of 1752	2208	rundll32.exe	28
PID 2208 wrote to memory of 1752	2208	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\BLL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\BLL.dll,#1
  2⤵
  PID:1752