3ac9336fac8e7a22e1db4caa56e277d2d8aa12c9ffe4b7b4b833b2f8ae70e669

Analysis

max time kernel
38s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/10/2022, 13:51

Target

3ac9336fac8e7a22e1db4caa56e277d2d8aa12c9ffe4b7b4b833b2f8ae70e669.dll
Size

603KB
MD5

91381815b188d68f8d6ac15704d23354
SHA1

8fbcd464587ba26e1e2883e54a7017e77329e0a7
SHA256

3ac9336fac8e7a22e1db4caa56e277d2d8aa12c9ffe4b7b4b833b2f8ae70e669
SHA512

f81c1a93a2d670db403bf725a1229f2e63af94a6711a4f1cd1d8b9eaee0f83ed9390a7ca7c152e0cd8870aedea8c3ea6084b4b647c56619e13954151624f521c
SSDEEP

6144:Ob2HnveeTMmk+5Ky1O1/3baIJ+Qh0OXx53q7:GknsF+511O1/baIJ+Qh/

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1164 wrote to memory of 1484	1164	rundll32.exe	28
PID 1164 wrote to memory of 1484	1164	rundll32.exe	28
PID 1164 wrote to memory of 1484	1164	rundll32.exe	28
PID 1164 wrote to memory of 1484	1164	rundll32.exe	28
PID 1164 wrote to memory of 1484	1164	rundll32.exe	28
PID 1164 wrote to memory of 1484	1164	rundll32.exe	28
PID 1164 wrote to memory of 1484	1164	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ac9336fac8e7a22e1db4caa56e277d2d8aa12c9ffe4b7b4b833b2f8ae70e669.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1164
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ac9336fac8e7a22e1db4caa56e277d2d8aa12c9ffe4b7b4b833b2f8ae70e669.dll,#1
  2⤵
  PID:1484

memory/1484-55-0x0000000075DA1000-0x0000000075DA3000-memory.dmp

Filesize
8KB

Download