b3a1485606de34c1a797201e98d30595237a211a8b1dc4d5bf0fa06727af12c2

Analysis

max time kernel
38s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 15:30

Target

b3a1485606de34c1a797201e98d30595237a211a8b1dc4d5bf0fa06727af12c2.dll
Size

52KB
MD5

6bbc83f42e6f3c9e1e8ec03b3d65696c
SHA1

a845841e776f44dae9ac3970e60dbefdbb421890
SHA256

b3a1485606de34c1a797201e98d30595237a211a8b1dc4d5bf0fa06727af12c2
SHA512

f074614eed1d31bc49c312fcfdfbfcaed0a48b4e8f24d860e26e86fbf3c600fbe86ce1ea7a240a01d9cde234d2f6c692ead17457551298d394d3d4d5d7ade2ea
SSDEEP

768:2788TBHR7oOj33NvwSFbyx9GGB8oYMW3Nz:2788TBHldxtbAcLoTW3Z

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 1940	900	rundll32.exe	27
PID 900 wrote to memory of 1940	900	rundll32.exe	27
PID 900 wrote to memory of 1940	900	rundll32.exe	27
PID 900 wrote to memory of 1940	900	rundll32.exe	27
PID 900 wrote to memory of 1940	900	rundll32.exe	27
PID 900 wrote to memory of 1940	900	rundll32.exe	27
PID 900 wrote to memory of 1940	900	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b3a1485606de34c1a797201e98d30595237a211a8b1dc4d5bf0fa06727af12c2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:900
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b3a1485606de34c1a797201e98d30595237a211a8b1dc4d5bf0fa06727af12c2.dll,#1
  2⤵
  PID:1940

memory/1940-55-0x0000000075C61000-0x0000000075C63000-memory.dmp

Filesize
8KB

Download