1b3da37d0315aa340acfd6d15903a942e95e2389187387f76e104c734c19a2b7

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 19:21

Target

1b3da37d0315aa340acfd6d15903a942e95e2389187387f76e104c734c19a2b7.dll
Size

63KB
MD5

4b6b45665be923fec8726657ff9151f0
SHA1

8ba0d3e6f52bc28ea4ccbbf09abfb0fbe47fe161
SHA256

1b3da37d0315aa340acfd6d15903a942e95e2389187387f76e104c734c19a2b7
SHA512

4dcbba9e4d9d07ea8948b83384d774be0e1c60a136c5a5a70d94c3575795898d9bc91bacb59c7d4516ec173eb7f6d55b312dc253c3d4d665e3fa3e418b4043ce
SSDEEP

1536:esWj3lpiGwzrXifCM1IIUxCZnoEMz1OWsoMOJF:NqiDzrXifdIIUxtSYF

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 952 wrote to memory of 1936	952	rundll32.exe	28
PID 952 wrote to memory of 1936	952	rundll32.exe	28
PID 952 wrote to memory of 1936	952	rundll32.exe	28
PID 952 wrote to memory of 1936	952	rundll32.exe	28
PID 952 wrote to memory of 1936	952	rundll32.exe	28
PID 952 wrote to memory of 1936	952	rundll32.exe	28
PID 952 wrote to memory of 1936	952	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1b3da37d0315aa340acfd6d15903a942e95e2389187387f76e104c734c19a2b7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:952
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1b3da37d0315aa340acfd6d15903a942e95e2389187387f76e104c734c19a2b7.dll,#1
  2⤵
  PID:1936

memory/1936-55-0x0000000075DA1000-0x0000000075DA3000-memory.dmp

Filesize
8KB

Download