b3fcedc28875079e8e288589d48b36a5c00d5057f29a60051891301a8a07b0bf

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 03:07

Target

b3fcedc28875079e8e288589d48b36a5c00d5057f29a60051891301a8a07b0bf.dll
Size

59KB
MD5

fb87487ef8cc1238001f62d4c9a55ba9
SHA1

91dcced1828b6e76111f806a17d97fdfacdbf22d
SHA256

b3fcedc28875079e8e288589d48b36a5c00d5057f29a60051891301a8a07b0bf
SHA512

f18df109344ef90d44a5dd871e33e8610ff901f5595dcdf53569a6c212c3b53a7e996fdeb81419fd73a58868e99f3cf139179c38de805e7266da3ce33d26ec1f
SSDEEP

1536:n7ZLNPp9pZBMAMcbj1/GRmE3sZFDaEx0cnPaQP1nZUHQET:7ZppUg/GOrDxdasKQ6

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 684	1668	rundll32.exe	28
PID 1668 wrote to memory of 684	1668	rundll32.exe	28
PID 1668 wrote to memory of 684	1668	rundll32.exe	28
PID 1668 wrote to memory of 684	1668	rundll32.exe	28
PID 1668 wrote to memory of 684	1668	rundll32.exe	28
PID 1668 wrote to memory of 684	1668	rundll32.exe	28
PID 1668 wrote to memory of 684	1668	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b3fcedc28875079e8e288589d48b36a5c00d5057f29a60051891301a8a07b0bf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b3fcedc28875079e8e288589d48b36a5c00d5057f29a60051891301a8a07b0bf.dll,#1
  2⤵
  PID:684

memory/684-55-0x0000000075241000-0x0000000075243000-memory.dmp

Filesize
8KB

Download