392b199f52399b127f5ce4da84ee26928e6dd9bdd583ce798b3a5ece9c9fe2f6

Analysis

max time kernel
420s
max time network
432s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 21:18

Target

3.dll
Size

492.9MB
MD5

b86afb4ad9d3647857fe2ca55ec51177
SHA1

f95f45ad679f3cd49169a9a5bbf76f5667d8ea35
SHA256

392b199f52399b127f5ce4da84ee26928e6dd9bdd583ce798b3a5ece9c9fe2f6
SHA512

8fb971cab83b724dcc1af6712749fb906d359062705b73838da323e0bd36e71583e8e4dbc1d80a75a74937e85c5e7299d18fa0355832960068209aa8480be7ce
SSDEEP

12288:FOCb9nj+pHReUp4Hn0HzLu0yumisJ7I9jnmORXFOf6iRjdPk87OJ25PJcpKnlip+:gjx+0TSRJ0FSii1qO6gxSMvFeMzZSlQ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1632 wrote to memory of 912	1632	rundll32.exe	rundll32.exe
PID 1632 wrote to memory of 912	1632	rundll32.exe	rundll32.exe
PID 1632 wrote to memory of 912	1632	rundll32.exe	rundll32.exe
PID 1632 wrote to memory of 912	1632	rundll32.exe	rundll32.exe
PID 1632 wrote to memory of 912	1632	rundll32.exe	rundll32.exe
PID 1632 wrote to memory of 912	1632	rundll32.exe	rundll32.exe
PID 1632 wrote to memory of 912	1632	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1632

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3.dll,#1
2⤵
PID:912

memory/912-54-0x0000000000000000-mapping.dmp

Download
memory/912-55-0x0000000076091000-0x0000000076093000-memory.dmp

Filesize
8KB

Download
memory/912-56-0x0000000000370000-0x0000000000487000-memory.dmp

Filesize
1.1MB

Download
memory/912-57-0x0000000010000000-0x0000000011000000-memory.dmp

Filesize
16.0MB

Download
memory/912-58-0x0000000010000000-0x0000000011000000-memory.dmp

Filesize
16.0MB

Download
memory/912-59-0x0000000000370000-0x000000000043C000-memory.dmp

Filesize
816KB

Download
memory/912-60-0x00000000005D0000-0x0000000000688000-memory.dmp

Filesize
736KB

Download
memory/912-61-0x00000000005D0000-0x0000000000688000-memory.dmp

Filesize
736KB

Download
memory/912-63-0x0000000010000000-0x0000000010101000-memory.dmp

Filesize
1.0MB

Download