3ab417d01dda1106d12eab99de61f5989ecd881250ec1a599e642555cf380046

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
28/11/2022, 03:12

Target

3ab417d01dda1106d12eab99de61f5989ecd881250ec1a599e642555cf380046.dll
Size

152KB
MD5

6e1fd1e95cd7095dea79b7b1a395d797
SHA1

36767cc01064764e851b03d55153b4809c8bdb91
SHA256

3ab417d01dda1106d12eab99de61f5989ecd881250ec1a599e642555cf380046
SHA512

066a903d8728a895c2d3242c6bfa2a61ec2ffa1ad9eb9be29d016be723e7e4b590f982b746abc291ac7168af5c132e7abac5fe00aff2fe0cfc7256d7bcd45bfc
SSDEEP

3072:zYWyVvknQMb3rhTSCWNJ26LMLmA6UWfU/sG5DeYKFXD4/5A5qNfHFV:ZGMlmNoF75jB5oyfn

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 1664	1100	rundll32.exe	27
PID 1100 wrote to memory of 1664	1100	rundll32.exe	27
PID 1100 wrote to memory of 1664	1100	rundll32.exe	27
PID 1100 wrote to memory of 1664	1100	rundll32.exe	27
PID 1100 wrote to memory of 1664	1100	rundll32.exe	27
PID 1100 wrote to memory of 1664	1100	rundll32.exe	27
PID 1100 wrote to memory of 1664	1100	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ab417d01dda1106d12eab99de61f5989ecd881250ec1a599e642555cf380046.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ab417d01dda1106d12eab99de61f5989ecd881250ec1a599e642555cf380046.dll,#1
  2⤵
  PID:1664

memory/1664-55-0x0000000074AD1000-0x0000000074AD3000-memory.dmp

Filesize
8KB

Download