3f6be5f6a35a51f2c4227cda9626c7b6fb7480b64d14a1b9f4ad630337080776

Analysis

max time kernel
40s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11-10-2022 18:29

Target

3f6be5f6a35a51f2c4227cda9626c7b6fb7480b64d14a1b9f4ad630337080776.dll
Size

15KB
MD5

1423c6745edf897aae3f853245201d00
SHA1

356d25226e7aa54e729f6a2ace3e99b3bc2e4c2b
SHA256

3f6be5f6a35a51f2c4227cda9626c7b6fb7480b64d14a1b9f4ad630337080776
SHA512

dd6cbe5857e9e3ad1d5fb6c732f93e7b8c82bfd1596cddada18f1a496b9a28ab08fb0a38bf55b6af80c01c0985961b2c2518ad2cc1aae4a35508b0541f7ad136
SSDEEP

96:chX1RrnZ/qWcrh2u2e/xloIPk2tCVYKeD704kjMga+SigD3pBd+n3ymoNoNBi3rK:c9TZ/GhPKIPxV0TpSnrd83/oFrC

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 1472	2020	rundll32.exe	26
PID 2020 wrote to memory of 1472	2020	rundll32.exe	26
PID 2020 wrote to memory of 1472	2020	rundll32.exe	26
PID 2020 wrote to memory of 1472	2020	rundll32.exe	26
PID 2020 wrote to memory of 1472	2020	rundll32.exe	26
PID 2020 wrote to memory of 1472	2020	rundll32.exe	26
PID 2020 wrote to memory of 1472	2020	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3f6be5f6a35a51f2c4227cda9626c7b6fb7480b64d14a1b9f4ad630337080776.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3f6be5f6a35a51f2c4227cda9626c7b6fb7480b64d14a1b9f4ad630337080776.dll,#1
  2⤵
  PID:1472

memory/1472-54-0x0000000000000000-mapping.dmp

Download
memory/1472-55-0x0000000075451000-0x0000000075453000-memory.dmp

Filesize
8KB

Download