3b0f9a71a647655695f14c61eac36b8c4d3b48a3578b3a5e9571dbdc9d6b4d7e

Analysis

max time kernel
9s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/10/2022, 13:46

Target

3b0f9a71a647655695f14c61eac36b8c4d3b48a3578b3a5e9571dbdc9d6b4d7e.dll
Size

65KB
MD5

6d657d506c5d8fe4d114176a62dcf4d4
SHA1

c31eb36ba4da5015f2ae569bf687a7b14f1f5591
SHA256

3b0f9a71a647655695f14c61eac36b8c4d3b48a3578b3a5e9571dbdc9d6b4d7e
SHA512

4f24f34594cd3d31df734ef554899fd59b0a06302078a7bf42ee28918de0beed8806c836131513d4d96ff908d8c551e1b87a54494434b3a59df3ca96845d5121
SSDEEP

1536:1SgNlCnMuats3qYfmh/sAB0g2DNWi/iKCRTm:1SWQnAsabEYD2ZZlsTm

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 1876	1964	rundll32.exe	28
PID 1964 wrote to memory of 1876	1964	rundll32.exe	28
PID 1964 wrote to memory of 1876	1964	rundll32.exe	28
PID 1964 wrote to memory of 1876	1964	rundll32.exe	28
PID 1964 wrote to memory of 1876	1964	rundll32.exe	28
PID 1964 wrote to memory of 1876	1964	rundll32.exe	28
PID 1964 wrote to memory of 1876	1964	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b0f9a71a647655695f14c61eac36b8c4d3b48a3578b3a5e9571dbdc9d6b4d7e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b0f9a71a647655695f14c61eac36b8c4d3b48a3578b3a5e9571dbdc9d6b4d7e.dll,#1
  2⤵
  PID:1876

memory/1876-55-0x0000000075A11000-0x0000000075A13000-memory.dmp

Filesize
8KB

Download
memory/1876-56-0x0000000010000000-0x000000001002A000-memory.dmp

Filesize
168KB

Download
memory/1876-57-0x0000000010000000-0x000000001002A000-memory.dmp

Filesize
168KB

Download
memory/1876-58-0x0000000010000000-0x000000001002A000-memory.dmp

Filesize
168KB

Download