a3ff2aa02a1d42db2de8b5789a08007f2385fd00c1902e9b97d9b9f3dec115c2

Analysis

max time kernel
39s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 02:02

Target

a3ff2aa02a1d42db2de8b5789a08007f2385fd00c1902e9b97d9b9f3dec115c2.dll
Size

508KB
MD5

652cabd8394433cadd098a056592f7a0
SHA1

a4464c50091f6a7a9c93a2fa65fafc860ce84c88
SHA256

a3ff2aa02a1d42db2de8b5789a08007f2385fd00c1902e9b97d9b9f3dec115c2
SHA512

c6d789466e2a32b09bccea35e9d68d909c692e5e69db7501e442e21053f0fa0c67537dd16da149d1aa78e00f3b87e095fd3a2c1e2be57195c80b4a5b1066b0bc
SSDEEP

12288:+jzRVbIKYEhWdr5fkXi8CtMgfDDP3e+bh0xnYj:+jzRVbqwWN5fkXi84fph0xnA

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 1920	2012	rundll32.exe	26
PID 2012 wrote to memory of 1920	2012	rundll32.exe	26
PID 2012 wrote to memory of 1920	2012	rundll32.exe	26
PID 2012 wrote to memory of 1920	2012	rundll32.exe	26
PID 2012 wrote to memory of 1920	2012	rundll32.exe	26
PID 2012 wrote to memory of 1920	2012	rundll32.exe	26
PID 2012 wrote to memory of 1920	2012	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a3ff2aa02a1d42db2de8b5789a08007f2385fd00c1902e9b97d9b9f3dec115c2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a3ff2aa02a1d42db2de8b5789a08007f2385fd00c1902e9b97d9b9f3dec115c2.dll,#1
  2⤵
  PID:1920

memory/1920-54-0x0000000000000000-mapping.dmp

Download
memory/1920-55-0x0000000075E81000-0x0000000075E83000-memory.dmp

Filesize
8KB

Download
memory/1920-56-0x0000000067400000-0x0000000067480000-memory.dmp

Filesize
512KB

Download