1b3582dfdf5d1d2324b67847f2c7415d21f40f19fb378bff9a3cc1f7edd27124

Analysis

max time kernel
42s
max time network
57s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 17:12

Target

1b3582dfdf5d1d2324b67847f2c7415d21f40f19fb378bff9a3cc1f7edd27124.dll
Size

168KB
MD5

96044bf435759b4f1855347b7be90d36
SHA1

caeecd8131840698633287c7ea49110ea779f751
SHA256

1b3582dfdf5d1d2324b67847f2c7415d21f40f19fb378bff9a3cc1f7edd27124
SHA512

3a6882c54fdf431d3826185c8cea48cdce27266e1353a69ff91c6b9eb3b3fe2790fa3c9b870307d8c590fe8c4c70f739f27d91bfa41d44c87926dbdba4be8f7a
SSDEEP

3072:L7hM2O8PvN8rw24smepxAW/wqYYwpvFPnSHiOFICP1zBBP2pHVG:11+v4JOAWdYYwNFPnDOFICddQ5

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1484 wrote to memory of 1748	1484	rundll32.exe	27
PID 1484 wrote to memory of 1748	1484	rundll32.exe	27
PID 1484 wrote to memory of 1748	1484	rundll32.exe	27
PID 1484 wrote to memory of 1748	1484	rundll32.exe	27
PID 1484 wrote to memory of 1748	1484	rundll32.exe	27
PID 1484 wrote to memory of 1748	1484	rundll32.exe	27
PID 1484 wrote to memory of 1748	1484	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1b3582dfdf5d1d2324b67847f2c7415d21f40f19fb378bff9a3cc1f7edd27124.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1484
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1b3582dfdf5d1d2324b67847f2c7415d21f40f19fb378bff9a3cc1f7edd27124.dll,#1
  2⤵
  PID:1748

memory/1748-55-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download
memory/1748-56-0x0000000000130000-0x0000000000142000-memory.dmp

Filesize
72KB

Download
memory/1748-57-0x0000000010000000-0x000000001005A000-memory.dmp

Filesize
360KB

Download