3b02b8999549944f68e8d3624f5a4f15c9d2c9aa7d15a0f8419fb40ab8725405

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/11/2022, 21:20

Target

3b02b8999549944f68e8d3624f5a4f15c9d2c9aa7d15a0f8419fb40ab8725405.dll
Size

117KB
MD5

0fdfe72e2bb2cffa49ab4729dba595e0
SHA1

a82a65efa6d2eaef240aa43e9e5ed64824d9efa0
SHA256

3b02b8999549944f68e8d3624f5a4f15c9d2c9aa7d15a0f8419fb40ab8725405
SHA512

82eea08761f417bf8706096f4c4611df8ff7497765ebc59ff073f7c07d59b65d8dade9a44223b0e38b0d9eb3ed7bcf90a04257789c23b19856911041b224aead
SSDEEP

3072:j+6TCy3sEUnafop/zvW/8AcCIbOwYGx3zq58OfsHNX0ob1M:S6TCy3sEUaQp/rblbOwvjuaES1M

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 864 wrote to memory of 1792	864	rundll32.exe	28
PID 864 wrote to memory of 1792	864	rundll32.exe	28
PID 864 wrote to memory of 1792	864	rundll32.exe	28
PID 864 wrote to memory of 1792	864	rundll32.exe	28
PID 864 wrote to memory of 1792	864	rundll32.exe	28
PID 864 wrote to memory of 1792	864	rundll32.exe	28
PID 864 wrote to memory of 1792	864	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b02b8999549944f68e8d3624f5a4f15c9d2c9aa7d15a0f8419fb40ab8725405.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:864
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b02b8999549944f68e8d3624f5a4f15c9d2c9aa7d15a0f8419fb40ab8725405.dll,#1
  2⤵
  PID:1792

memory/1792-55-0x0000000076321000-0x0000000076323000-memory.dmp

Filesize
8KB

Download
memory/1792-56-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download
memory/1792-57-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download
memory/1792-58-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download