c3204b219a1e2fea5a3e542dcf4c02791702fbadc35733d7872644a14e48eb0e

Analysis

max time kernel
44s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 18:12

Target

c3204b219a1e2fea5a3e542dcf4c02791702fbadc35733d7872644a14e48eb0e.dll
Size

108KB
MD5

c1028b6a2ad191e33bd6605e80615772
SHA1

acaec4ab5b938e2492a93c9ced66e72ef8f034b9
SHA256

c3204b219a1e2fea5a3e542dcf4c02791702fbadc35733d7872644a14e48eb0e
SHA512

f7621103c3b20baae05edea9de5bdb8d368748bd800610075373d930b43d0132a6bf962ebcac69094fd539214f0e70c75c2256510585d128b3e877869389b7ce
SSDEEP

1536:VK/MFocGogybG+60Q+uEEpBl2+Q1BvEnSpEqN2PpdGixX3jHOlalN05m:VUKocH6MQ+uZ0R15//arZalalNcm

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1348 wrote to memory of 844	1348	rundll32.exe	27
PID 1348 wrote to memory of 844	1348	rundll32.exe	27
PID 1348 wrote to memory of 844	1348	rundll32.exe	27
PID 1348 wrote to memory of 844	1348	rundll32.exe	27
PID 1348 wrote to memory of 844	1348	rundll32.exe	27
PID 1348 wrote to memory of 844	1348	rundll32.exe	27
PID 1348 wrote to memory of 844	1348	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c3204b219a1e2fea5a3e542dcf4c02791702fbadc35733d7872644a14e48eb0e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1348
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c3204b219a1e2fea5a3e542dcf4c02791702fbadc35733d7872644a14e48eb0e.dll,#1
  2⤵
  PID:844

memory/844-55-0x0000000075601000-0x0000000075603000-memory.dmp

Filesize
8KB

Download