c3acf9dd3d53a8912d162dcbb0fc09c01a2a4e32afacfd6fa5221ffee42c4338

Analysis

max time kernel
39s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-12-2022 00:44

Target

c3acf9dd3d53a8912d162dcbb0fc09c01a2a4e32afacfd6fa5221ffee42c4338.dll
Size

6KB
MD5

a3367227aa376cef6531ac8960beb720
SHA1

ba51ce32673e4fcfb5f7828cb070c8b33945d430
SHA256

c3acf9dd3d53a8912d162dcbb0fc09c01a2a4e32afacfd6fa5221ffee42c4338
SHA512

86cf80c1686c3af2dfdf36fe5474ef4867b1064fed23f70be5a617c31898a2ae481b0dd9d4fabce091254ef2f52359a7bd4c263366cd50d74d5d6cad72204d85
SSDEEP

192:EHRh1epp4hlYhTld/cQq5cTFBbxWoO95vn:EHROWhlYhTld/cQq5cTFBbxW795vn

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 1940	900	rundll32.exe	27
PID 900 wrote to memory of 1940	900	rundll32.exe	27
PID 900 wrote to memory of 1940	900	rundll32.exe	27
PID 900 wrote to memory of 1940	900	rundll32.exe	27
PID 900 wrote to memory of 1940	900	rundll32.exe	27
PID 900 wrote to memory of 1940	900	rundll32.exe	27
PID 900 wrote to memory of 1940	900	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c3acf9dd3d53a8912d162dcbb0fc09c01a2a4e32afacfd6fa5221ffee42c4338.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:900
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c3acf9dd3d53a8912d162dcbb0fc09c01a2a4e32afacfd6fa5221ffee42c4338.dll,#1
  2⤵
  PID:1940

memory/1940-55-0x0000000075C61000-0x0000000075C63000-memory.dmp

Filesize
8KB

Download