e3dd04c52bba96d57bcc3f753021a1e06353def8e2106064b4da4b4223d4b9d6

Analysis

max time kernel
40s
max time network
43s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/02/2023, 12:43

Target

e3dd04c52bba96d57bcc3f753021a1e06353def8e2106064b4da4b4223d4b9d6.dll
Size

5.3MB
MD5

3b67bbccbf0b476f1ee97499b7b33e0d
SHA1

9d7dc90d45edfbb8406134ef0e099a09038e6ac0
SHA256

e3dd04c52bba96d57bcc3f753021a1e06353def8e2106064b4da4b4223d4b9d6
SHA512

6fddbb7f766a68802baa738e9167260e8db97eb9e42699b47024043233a99ec18b925c4f08034a6baab86a4cf3d2cff965362cd1a32456fd45a7aa206552ceaf
SSDEEP

98304:+fkEzeYa/G+ttrE0dFDQ+98tbWbiwy4M7zBE9isk9D++9mTHSJnjav3a2ObBuF2h:CzeYae+80dO+WZgfyIgNwTyJnjqa2ewm

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 1476	1096	rundll32.exe	26
PID 1096 wrote to memory of 1476	1096	rundll32.exe	26
PID 1096 wrote to memory of 1476	1096	rundll32.exe	26
PID 1096 wrote to memory of 1476	1096	rundll32.exe	26
PID 1096 wrote to memory of 1476	1096	rundll32.exe	26
PID 1096 wrote to memory of 1476	1096	rundll32.exe	26
PID 1096 wrote to memory of 1476	1096	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e3dd04c52bba96d57bcc3f753021a1e06353def8e2106064b4da4b4223d4b9d6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e3dd04c52bba96d57bcc3f753021a1e06353def8e2106064b4da4b4223d4b9d6.dll,#1
  2⤵
  PID:1476

memory/1476-55-0x00000000768A1000-0x00000000768A3000-memory.dmp

Filesize
8KB

Download
memory/1476-56-0x0000000002140000-0x0000000002685000-memory.dmp

Filesize
5.3MB

Download