d3a35097b013d08a9a5b6faf985719ab7a504b8dce5328660ae015bfdfb3fd92

Analysis

max time kernel
38s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
21/11/2022, 16:38

Target

d3a35097b013d08a9a5b6faf985719ab7a504b8dce5328660ae015bfdfb3fd92.dll
Size

63KB
MD5

20c0a1d64218809a8a2020b2701cb990
SHA1

c57981c83abd0b7b347d0aef2a63e0cb682c946a
SHA256

d3a35097b013d08a9a5b6faf985719ab7a504b8dce5328660ae015bfdfb3fd92
SHA512

8a9153abb96601472c92f71c1465f770ae01f551291638ec32006ae4278e97e40563633430217bf29b8dc7cbd0f710bd2efbf23b3917615b72dcaa3d5a39e596
SSDEEP

768:/DXu0V3zGNSeds+Qyae54HOat4SRFZOfX0mbnY6F:zuMaKsHID0fxF

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 1944	1708	rundll32.exe	26
PID 1708 wrote to memory of 1944	1708	rundll32.exe	26
PID 1708 wrote to memory of 1944	1708	rundll32.exe	26
PID 1708 wrote to memory of 1944	1708	rundll32.exe	26
PID 1708 wrote to memory of 1944	1708	rundll32.exe	26
PID 1708 wrote to memory of 1944	1708	rundll32.exe	26
PID 1708 wrote to memory of 1944	1708	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3a35097b013d08a9a5b6faf985719ab7a504b8dce5328660ae015bfdfb3fd92.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3a35097b013d08a9a5b6faf985719ab7a504b8dce5328660ae015bfdfb3fd92.dll,#1
  2⤵
  PID:1944

memory/1944-55-0x0000000075451000-0x0000000075453000-memory.dmp

Filesize
8KB

Download