3dd835b9e9c65fe4063f182a989189021bb25269116df45252d73e05615ffc4e

Analysis

max time kernel
32s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 14:48

Target

3dd835b9e9c65fe4063f182a989189021bb25269116df45252d73e05615ffc4e.dll
Size

57KB
MD5

6eac1a0af2f561cc98433cbc7238be1d
SHA1

6a009ff8c5932910c43ef8160525809ee4cf156b
SHA256

3dd835b9e9c65fe4063f182a989189021bb25269116df45252d73e05615ffc4e
SHA512

c3e5dc7f3257de5f96b2c7acc3490c4aff11b0b855466d2be9ec43d62f8faa795aea152508f00b0c3551727cb7d149f22fde55f39826cbbd00f894f41a2e2135
SSDEEP

1536:SNIKDp4YU6EMyDcqiZZZNihyISFIR6/JP+3CT:Tqp4YU6ErtGNEKIpCT

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 1780	1884	rundll32.exe	28
PID 1884 wrote to memory of 1780	1884	rundll32.exe	28
PID 1884 wrote to memory of 1780	1884	rundll32.exe	28
PID 1884 wrote to memory of 1780	1884	rundll32.exe	28
PID 1884 wrote to memory of 1780	1884	rundll32.exe	28
PID 1884 wrote to memory of 1780	1884	rundll32.exe	28
PID 1884 wrote to memory of 1780	1884	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd835b9e9c65fe4063f182a989189021bb25269116df45252d73e05615ffc4e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd835b9e9c65fe4063f182a989189021bb25269116df45252d73e05615ffc4e.dll,#1
  2⤵
  PID:1780

memory/1780-55-0x0000000076321000-0x0000000076323000-memory.dmp

Filesize
8KB

Download