e3697831bcd29abfaf0a2b7d74b5b42d0ebaef5625f45b617170bfeeade8af70

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 22:02

Target

bass.dll
Size

106KB
MD5

99c2d4bce27b70a26b9c6f68691f6777
SHA1

82386b2d2668175e9e61aeff4908a30352ced716
SHA256

d0d43cbde1edea42062afd34ecfcd1a3632417d92e69cb72d6a37afce145497c
SHA512

8e8523cf7b6ae04fbd48063160fe73d5b55c985000dda3ab6690d6539c9f6657583f77a90861750b3d89c7f50b1b751c4a7f5aeed7424f7ad4534cd707acaaf0
SSDEEP

3072:U1DVE1w3gFE77CHeHxopp5NSQwuQjc7/iDso:U1REZ67+He+Lc2

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 1440	1984	rundll32.exe	31
PID 1984 wrote to memory of 1440	1984	rundll32.exe	31
PID 1984 wrote to memory of 1440	1984	rundll32.exe	31
PID 1984 wrote to memory of 1440	1984	rundll32.exe	31
PID 1984 wrote to memory of 1440	1984	rundll32.exe	31
PID 1984 wrote to memory of 1440	1984	rundll32.exe	31
PID 1984 wrote to memory of 1440	1984	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bass.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bass.dll,#1
  2⤵
  PID:1440

memory/1440-3-0x0000000010000000-0x0000000010054000-memory.dmp

Filesize
336KB

Download
memory/1440-2-0x0000000010000000-0x0000000010054000-memory.dmp

Filesize
336KB

Download
memory/1440-1-0x0000000010000000-0x0000000010054000-memory.dmp

Filesize
336KB

Download
memory/1440-0-0x0000000010000000-0x0000000010054000-memory.dmp

Filesize
336KB

Download
memory/1440-4-0x0000000010053000-0x0000000010054000-memory.dmp

Filesize
4KB

Download