3e8db90bc552de43469aabcd8eb14177d6cbd782d98a8a8e69fbb91f8e3da9a2

Analysis

max time kernel
40s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 21:13

Target

3e8db90bc552de43469aabcd8eb14177d6cbd782d98a8a8e69fbb91f8e3da9a2.dll
Size

5KB
MD5

5c07a7203264c063257ce1c39e34b5d0
SHA1

387bbd38e2cb9185691b9751ed707c5973e323ee
SHA256

3e8db90bc552de43469aabcd8eb14177d6cbd782d98a8a8e69fbb91f8e3da9a2
SHA512

ead8d4f4644582c3ad93d463b21778049a43c017d6b352c20766df01b73c012dc2634ad0550f9e46f7d7bf50168bef797b4a2046e9b6f457c792ab859b055c2c
SSDEEP

96:XprYDpKnI6wJ+Ls7guyHejyn/I9l0iaiCjPze:XUcA+ggd+W/If0i4jze

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 456 wrote to memory of 1992	456	rundll32.exe	28
PID 456 wrote to memory of 1992	456	rundll32.exe	28
PID 456 wrote to memory of 1992	456	rundll32.exe	28
PID 456 wrote to memory of 1992	456	rundll32.exe	28
PID 456 wrote to memory of 1992	456	rundll32.exe	28
PID 456 wrote to memory of 1992	456	rundll32.exe	28
PID 456 wrote to memory of 1992	456	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3e8db90bc552de43469aabcd8eb14177d6cbd782d98a8a8e69fbb91f8e3da9a2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:456
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3e8db90bc552de43469aabcd8eb14177d6cbd782d98a8a8e69fbb91f8e3da9a2.dll,#1
  2⤵
  PID:1992

memory/1992-55-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download