a3d9ad11ec2008c1772d28b94b144d4904f2837d4a17e6ebe84cc1a5997fb4ea

Analysis

max time kernel
25s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 20:52

Target

a3d9ad11ec2008c1772d28b94b144d4904f2837d4a17e6ebe84cc1a5997fb4ea.dll
Size

141KB
MD5

8da32f9ef0b2a49f035ad16539541338
SHA1

2c23871b8a898ade854b366e53f46dd928c43644
SHA256

a3d9ad11ec2008c1772d28b94b144d4904f2837d4a17e6ebe84cc1a5997fb4ea
SHA512

a492d777c3b569321adcd5c91e3137a433f4b4337fefa2482c5d0141484e83eee0e0e6b862574b3b898af5b8ea2ef7551cffe3de69fafa962d17a8c573fff8a4
SSDEEP

3072:fONjACAP9JRa4Eg50p6Q/TRM0o2UFfPTo2MvX2ok2G4+rwHvYMA+:fONUCA/Rpj1iM01STZa+rUAMA+

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 1696	2044	rundll32.exe	28
PID 2044 wrote to memory of 1696	2044	rundll32.exe	28
PID 2044 wrote to memory of 1696	2044	rundll32.exe	28
PID 2044 wrote to memory of 1696	2044	rundll32.exe	28
PID 2044 wrote to memory of 1696	2044	rundll32.exe	28
PID 2044 wrote to memory of 1696	2044	rundll32.exe	28
PID 2044 wrote to memory of 1696	2044	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a3d9ad11ec2008c1772d28b94b144d4904f2837d4a17e6ebe84cc1a5997fb4ea.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a3d9ad11ec2008c1772d28b94b144d4904f2837d4a17e6ebe84cc1a5997fb4ea.dll,#1
  2⤵
  PID:1696

memory/1696-55-0x0000000076941000-0x0000000076943000-memory.dmp

Filesize
8KB

Download