35ba3c2462f2e243f5adc9d167a614b0a2720f7ed35209574bbfee0215661386

Analysis

max time kernel
36s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 13:04

Target

35ba3c2462f2e243f5adc9d167a614b0a2720f7ed35209574bbfee0215661386.dll
Size

68KB
MD5

ec3ebf8409622b22a1d2a92ac1f2b3c3
SHA1

64d0c1cf473c4f3f28731d79af705b5092bb3972
SHA256

35ba3c2462f2e243f5adc9d167a614b0a2720f7ed35209574bbfee0215661386
SHA512

2fa4f2174363e06bfb002dc04e6de0b487935b0e46ff9ed1ff7d7820444e00fa102d04d418c8c7fd7357c09426401f335052dc427eed138082e2edce50d65a16
SSDEEP

768:LYpiPD18ljSbGfSNN9DNwHWg4hMUlNEj72ANvdIU/wHRB9+JbrL0hhAUC5ZhS9dw:wWb/bDCS6jNb/wHn9mrLUlJClP48

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 1980	1992	rundll32.exe	26
PID 1992 wrote to memory of 1980	1992	rundll32.exe	26
PID 1992 wrote to memory of 1980	1992	rundll32.exe	26
PID 1992 wrote to memory of 1980	1992	rundll32.exe	26
PID 1992 wrote to memory of 1980	1992	rundll32.exe	26
PID 1992 wrote to memory of 1980	1992	rundll32.exe	26
PID 1992 wrote to memory of 1980	1992	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\35ba3c2462f2e243f5adc9d167a614b0a2720f7ed35209574bbfee0215661386.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\35ba3c2462f2e243f5adc9d167a614b0a2720f7ed35209574bbfee0215661386.dll,#1
  2⤵
  PID:1980

memory/1980-55-0x0000000076141000-0x0000000076143000-memory.dmp

Filesize
8KB

Download