e2dca85ba15366a41846b1152329ad9c7abc8b410b5ee51d00b812c1d1eae761

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 04:39

Target

?????10?/bbxcomm.dll
Size

339KB
MD5

0c0731b749a20a9f687b54976e1f1277
SHA1

93a2253f1e87a78c7ef8d4b841d31450f4c7d49e
SHA256

6d7ba5076c454b527b0dad54b43b4e08af27baf902d47421a6a8d0ce92c6c058
SHA512

cff7c7dd67da851f8637de66b0864b019e417c5dd5423ac9a20455d92ccf2e717a5dc5ac2820848a6a5706ef0609100dd3081557b84ec2e9580f8d25e48a1105
SSDEEP

3072:2k/XVm652zDx0l1pKxXdaY4vzouz+ocGKu0H6JymjIpZhNSM44G4444444444D4S:2k/XVpi0lDKkou8GK16JymjIp8pTpQLw

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1692 wrote to memory of 1664	1692	rundll32.exe	rundll32.exe
PID 1692 wrote to memory of 1664	1692	rundll32.exe	rundll32.exe
PID 1692 wrote to memory of 1664	1692	rundll32.exe	rundll32.exe
PID 1692 wrote to memory of 1664	1692	rundll32.exe	rundll32.exe
PID 1692 wrote to memory of 1664	1692	rundll32.exe	rundll32.exe
PID 1692 wrote to memory of 1664	1692	rundll32.exe	rundll32.exe
PID 1692 wrote to memory of 1664	1692	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\_____10_\bbxcomm.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1692

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\_____10_\bbxcomm.dll,#1
2⤵
PID:1664