4b6e5ae794eed42a30f20cb41c9b7d9c516fe1ec8349c5f0d4d5d4401ca7961a

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 20:17

Target

3ad19a77a0752b847e7f17074e72c2ec.dll
Size

132KB
MD5

3ad19a77a0752b847e7f17074e72c2ec
SHA1

f56d40f4be96d66cb4509dbc38a19b6bdcfbfa2b
SHA256

4b6e5ae794eed42a30f20cb41c9b7d9c516fe1ec8349c5f0d4d5d4401ca7961a
SHA512

9ffc73521e16cd0c0e639d77ba4054b56b3832b1c51d0f5aeac42da7ffd18f6ca26cdc7d5d213277db51413c11c70f4c8c862ff99cb585e7c24196db5432f638
SSDEEP

3072:Dp/L09XdW95jh4L6PAhpYSJVu3ay7qVFSjEHnaLw1Z5:Dp/LEXdW9RCL64hCSTkx74Hnasv5

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 3000	2172	rundll32.exe	28
PID 2172 wrote to memory of 3000	2172	rundll32.exe	28
PID 2172 wrote to memory of 3000	2172	rundll32.exe	28
PID 2172 wrote to memory of 3000	2172	rundll32.exe	28
PID 2172 wrote to memory of 3000	2172	rundll32.exe	28
PID 2172 wrote to memory of 3000	2172	rundll32.exe	28
PID 2172 wrote to memory of 3000	2172	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ad19a77a0752b847e7f17074e72c2ec.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ad19a77a0752b847e7f17074e72c2ec.dll,#1
  2⤵
  PID:3000

memory/3000-0-0x0000000000170000-0x0000000000192000-memory.dmp

Filesize
136KB

Download
memory/3000-1-0x0000000000170000-0x0000000000192000-memory.dmp

Filesize
136KB

Download
memory/3000-2-0x0000000000180000-0x00000000001A2000-memory.dmp

Filesize
136KB

Download
memory/3000-3-0x0000000040960000-0x0000000040971000-memory.dmp

Filesize
68KB

Download
memory/3000-4-0x0000000000180000-0x00000000001A2000-memory.dmp

Filesize
136KB

Download