3b90a08e7fae60dd32e7c246fdc0a391afce06698716a844dbbe8a5077801edf

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
10/12/2023, 23:55

Target

3b90a08e7fae60dd32e7c246fdc0a391afce06698716a844dbbe8a5077801edf.dll
Size

57KB
MD5

6a4533c3d140f163155f6bdaa75924c1
SHA1

e9771972779b02d7ba7cbbddfa5395bfd055384a
SHA256

3b90a08e7fae60dd32e7c246fdc0a391afce06698716a844dbbe8a5077801edf
SHA512

d018e04877b9f918cfede02dbc6dbf96f6b456808da27bc0c00da079fd45e6da1098e75c58691516244bc7884839c238c5a2d073a58b2b8e22afcb8433c78189
SSDEEP

1536:zKo7B888888888888W88888888888BvE:zKoN888888888888W88888888888+

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 2816	2068	rundll32.exe	28
PID 2068 wrote to memory of 2816	2068	rundll32.exe	28
PID 2068 wrote to memory of 2816	2068	rundll32.exe	28
PID 2068 wrote to memory of 2816	2068	rundll32.exe	28
PID 2068 wrote to memory of 2816	2068	rundll32.exe	28
PID 2068 wrote to memory of 2816	2068	rundll32.exe	28
PID 2068 wrote to memory of 2816	2068	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b90a08e7fae60dd32e7c246fdc0a391afce06698716a844dbbe8a5077801edf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b90a08e7fae60dd32e7c246fdc0a391afce06698716a844dbbe8a5077801edf.dll,#1
  2⤵
  PID:2816