3b0e3c285673f1e28af37eb24bbb8fc64159a684ddb931132fb7ccd9f6857dcc

Analysis

max time kernel
135s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
07-06-2023 19:20

Target

3b0e3c285673f1e28af37eb24bbb8fc64159a684ddb931132fb7ccd9f6857dcc.dll
Size

952KB
MD5

8a732a0ff80542045e3504a501ff816e
SHA1

1076601234dc31622af7ef7fe957508754b525a9
SHA256

3b0e3c285673f1e28af37eb24bbb8fc64159a684ddb931132fb7ccd9f6857dcc
SHA512

8a7aab8fccde89792e5896cc930d61957c525de4a1a2f90cc18ebb59eb933879daa7fddb146c705ef0dffce66723dd234f28b90d2310d73a004332209748f57a
SSDEEP

24576:64W35M4TRtWj22TO3wF/sRAoL/anfgfPXnQcnq7uhP/M+:6P5MYF2TWW/NcXnQcq7q3d

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1644 wrote to memory of 3988	1644	rundll32.exe	rundll32.exe
PID 1644 wrote to memory of 3988	1644	rundll32.exe	rundll32.exe
PID 1644 wrote to memory of 3988	1644	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b0e3c285673f1e28af37eb24bbb8fc64159a684ddb931132fb7ccd9f6857dcc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1644

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b0e3c285673f1e28af37eb24bbb8fc64159a684ddb931132fb7ccd9f6857dcc.dll,#1
2⤵
PID:3988

memory/3988-133-0x0000000002430000-0x000000000287C000-memory.dmp

Filesize
4.3MB

Download