a3ffb8e025b0298097c7dc1caf09ff6f6626ef5f40125c980c1e0cdab8b4a8d4

Analysis

max time kernel
89s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 20:19

Target

a3ffb8e025b0298097c7dc1caf09ff6f6626ef5f40125c980c1e0cdab8b4a8d4.dll
Size

88KB
MD5

ee70bb5f22a2ac357252dc95022f1b00
SHA1

2e9d5a6d16b659cf678ef099f65ab83dd7ce3d10
SHA256

a3ffb8e025b0298097c7dc1caf09ff6f6626ef5f40125c980c1e0cdab8b4a8d4
SHA512

8846511cd7ffc71b0001ff343cc27af53ad6df6b7c5507379c601b79dbd30dfeb9e62379106395dcd080f4f9e774294d235bc47329dea15e21aba010352eb62a
SSDEEP

1536:aI9js9B05V54qPFWNpMdOQU9dlCnojB/QiIdBmIxHyQD4:Xjs9B6AqAMifG8oHhD4

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 560	1504	rundll32.exe	28
PID 1504 wrote to memory of 560	1504	rundll32.exe	28
PID 1504 wrote to memory of 560	1504	rundll32.exe	28
PID 1504 wrote to memory of 560	1504	rundll32.exe	28
PID 1504 wrote to memory of 560	1504	rundll32.exe	28
PID 1504 wrote to memory of 560	1504	rundll32.exe	28
PID 1504 wrote to memory of 560	1504	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a3ffb8e025b0298097c7dc1caf09ff6f6626ef5f40125c980c1e0cdab8b4a8d4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a3ffb8e025b0298097c7dc1caf09ff6f6626ef5f40125c980c1e0cdab8b4a8d4.dll,#1
  2⤵
  PID:560

memory/560-55-0x0000000075C11000-0x0000000075C13000-memory.dmp

Filesize
8KB

Download