3fdee2d2586b07fd0a5e85c13dedbc49954a8c13e033cecfc1d6efb15146ac5e

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 14:57

Target

3fdee2d2586b07fd0a5e85c13dedbc49954a8c13e033cecfc1d6efb15146ac5e.dll
Size

151KB
MD5

1a35c5c6f87e0121d66d2f2db274eff9
SHA1

c3b87b5707025bfec9fd935746d67a42725aa8f5
SHA256

3fdee2d2586b07fd0a5e85c13dedbc49954a8c13e033cecfc1d6efb15146ac5e
SHA512

be6e1b346d3c33982b7d2ba0cd3ddcae30586478df5e49d5d26f4e65633bba7c6b8686c685dcef3dbb061e4816272781d01e9e0b86cded992b5144472a056eb9
SSDEEP

1536:tIsIwXI2IuIJkuvfZ/AuwtICVmG04D6OFcK5vcZSFCtluRR3u5xUSTP:t7ZFNyxvfGx04iK5yy9u5x

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1212 wrote to memory of 1356	1212	rundll32.exe	28
PID 1212 wrote to memory of 1356	1212	rundll32.exe	28
PID 1212 wrote to memory of 1356	1212	rundll32.exe	28
PID 1212 wrote to memory of 1356	1212	rundll32.exe	28
PID 1212 wrote to memory of 1356	1212	rundll32.exe	28
PID 1212 wrote to memory of 1356	1212	rundll32.exe	28
PID 1212 wrote to memory of 1356	1212	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3fdee2d2586b07fd0a5e85c13dedbc49954a8c13e033cecfc1d6efb15146ac5e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1212
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3fdee2d2586b07fd0a5e85c13dedbc49954a8c13e033cecfc1d6efb15146ac5e.dll,#1
  2⤵
  PID:1356

memory/1356-55-0x0000000076711000-0x0000000076713000-memory.dmp

Filesize
8KB

Download
memory/1356-56-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download