3fe432182cd16bc38e570c4b244507b10f0e305328f127ee51ade0ff29355123

Analysis

max time kernel
122s
max time network
141s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 02:36

Target

00513a0893dd26507da397541a99cd78.dll
Size

332KB
MD5

00513a0893dd26507da397541a99cd78
SHA1

b6d9725524bf8871bb283eacafe16a421885c957
SHA256

3fe432182cd16bc38e570c4b244507b10f0e305328f127ee51ade0ff29355123
SHA512

df8e186e9c7bc222634bd9a23197bd03edd983f0a2c61aef038eab83d87d7c9d45bf47612664f4b1cfbb0efad33ce2758a059d41e88e3036f97b63d74a681dc4
SSDEEP

3072:1XfTy2lnJ9AuB44nFYJnlCTijZqMNFsjODop6ablIJaAZyaC5uNesbjGd/:1PTygJOuB4IEvQODop6abluagy4

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 2680	1200	rundll32.exe	27
PID 1200 wrote to memory of 2680	1200	rundll32.exe	27
PID 1200 wrote to memory of 2680	1200	rundll32.exe	27
PID 1200 wrote to memory of 2680	1200	rundll32.exe	27
PID 1200 wrote to memory of 2680	1200	rundll32.exe	27
PID 1200 wrote to memory of 2680	1200	rundll32.exe	27
PID 1200 wrote to memory of 2680	1200	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\00513a0893dd26507da397541a99cd78.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\00513a0893dd26507da397541a99cd78.dll,#1
  2⤵
  PID:2680

memory/2680-0-0x0000000010000000-0x000000001007D000-memory.dmp

Filesize
500KB

Download
memory/2680-1-0x0000000010000000-0x000000001007D000-memory.dmp

Filesize
500KB

Download