f3deccce1c0b70aa6d83a0393a50cef0ef686b6d85350f5e3bfbb5d7ea242cef

Analysis

max time kernel
17s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-10-2022 17:28

Target

f3deccce1c0b70aa6d83a0393a50cef0ef686b6d85350f5e3bfbb5d7ea242cef.dll
Size

152KB
MD5

a37b15f3e4a7f8051b9d0a433b60acc0
SHA1

e691999a218316c05a2f7197b0a52d9405ae2fab
SHA256

f3deccce1c0b70aa6d83a0393a50cef0ef686b6d85350f5e3bfbb5d7ea242cef
SHA512

73daed112f6763d42bf0ee6cadaea386c6a366f9cd7a07a6bb1790c26ec481fc748b7aab45fa10f29845306406b416ee2f77ec57385e844ca6aa923be777cc3b
SSDEEP

3072:sktNwyLv/ENXtvnOGayrkDDibFSYgxwRH4tch:skt28d7yMuF0GYt

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1284 wrote to memory of 1420	1284	rundll32.exe	28
PID 1284 wrote to memory of 1420	1284	rundll32.exe	28
PID 1284 wrote to memory of 1420	1284	rundll32.exe	28
PID 1284 wrote to memory of 1420	1284	rundll32.exe	28
PID 1284 wrote to memory of 1420	1284	rundll32.exe	28
PID 1284 wrote to memory of 1420	1284	rundll32.exe	28
PID 1284 wrote to memory of 1420	1284	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f3deccce1c0b70aa6d83a0393a50cef0ef686b6d85350f5e3bfbb5d7ea242cef.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1284
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f3deccce1c0b70aa6d83a0393a50cef0ef686b6d85350f5e3bfbb5d7ea242cef.dll,#1
  2⤵
  PID:1420

memory/1420-55-0x00000000762F1000-0x00000000762F3000-memory.dmp

Filesize
8KB

Download
memory/1420-56-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/1420-57-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/1420-58-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download