b3b2a4fc34d5f567350106a3db9da564641b15dbe5169d12d0466e6d2ff4cb17

Analysis

max time kernel
41s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 13:18

Target

b3b2a4fc34d5f567350106a3db9da564641b15dbe5169d12d0466e6d2ff4cb17.dll
Size

21KB
MD5

0f83b2c00ef5dc3badc1acaeb8319a90
SHA1

9e1b422d9a1e21365a6125fcfe1605a82d4e95d5
SHA256

b3b2a4fc34d5f567350106a3db9da564641b15dbe5169d12d0466e6d2ff4cb17
SHA512

7b5b6d05d7b22163cf302209a07b8555e93217bd3d7b2c68f8ad2330105324f2df70c64c657fa91bc47a843169f318ffbded94ef18bf01fbc53a4d03f76ee40e
SSDEEP

384:CR8B2rSCE6puPi3wt5LmDN1/YvgD7kJ2+Pma6aOn9HBfAZv7Wn:CRg2A6ga3pDXogvy2ra6a7W

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1424 wrote to memory of 1852	1424	rundll32.exe	26
PID 1424 wrote to memory of 1852	1424	rundll32.exe	26
PID 1424 wrote to memory of 1852	1424	rundll32.exe	26
PID 1424 wrote to memory of 1852	1424	rundll32.exe	26
PID 1424 wrote to memory of 1852	1424	rundll32.exe	26
PID 1424 wrote to memory of 1852	1424	rundll32.exe	26
PID 1424 wrote to memory of 1852	1424	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b3b2a4fc34d5f567350106a3db9da564641b15dbe5169d12d0466e6d2ff4cb17.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1424
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b3b2a4fc34d5f567350106a3db9da564641b15dbe5169d12d0466e6d2ff4cb17.dll,#1
  2⤵
  PID:1852

memory/1852-55-0x0000000076151000-0x0000000076153000-memory.dmp

Filesize
8KB

Download
memory/1852-56-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1852-57-0x0000000000140000-0x0000000000150000-memory.dmp

Filesize
64KB

Download