3ea96c57859bc29c5ad153aff1ea7c7139bd61ee7fb0fba5baf43ab4aab59f81

Analysis

max time kernel
34s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 21:23

Target

3ea96c57859bc29c5ad153aff1ea7c7139bd61ee7fb0fba5baf43ab4aab59f81.dll
Size

5KB
MD5

018fcb8eb304dabd0339e04a79c598a0
SHA1

a36b4a072731b80bf5de0a95aa2533e43e8935a8
SHA256

3ea96c57859bc29c5ad153aff1ea7c7139bd61ee7fb0fba5baf43ab4aab59f81
SHA512

c5c7824900b66f8388260e5b6d46f89f54a6284d17cd4b21efff7090bc93d76f57dc67b900eb862ed6ad0001c9b5eda7da8657f55b3ba2e164eb1ea8a34ac2a8
SSDEEP

96:FtrRdrY0x7+PZT2nwDnJzOGYS7N7N7x5EQ0:Ft11+PN2nwDnJzOGYO99xZ0

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 1960	1788	rundll32.exe	28
PID 1788 wrote to memory of 1960	1788	rundll32.exe	28
PID 1788 wrote to memory of 1960	1788	rundll32.exe	28
PID 1788 wrote to memory of 1960	1788	rundll32.exe	28
PID 1788 wrote to memory of 1960	1788	rundll32.exe	28
PID 1788 wrote to memory of 1960	1788	rundll32.exe	28
PID 1788 wrote to memory of 1960	1788	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ea96c57859bc29c5ad153aff1ea7c7139bd61ee7fb0fba5baf43ab4aab59f81.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ea96c57859bc29c5ad153aff1ea7c7139bd61ee7fb0fba5baf43ab4aab59f81.dll,#1
  2⤵
  PID:1960

memory/1960-55-0x0000000076321000-0x0000000076323000-memory.dmp

Filesize
8KB

Download