5f1aa4e7f1f3f251973597757bc99488e1ff2f88405e76d0f6ebb907c1ea4bbc

Analysis

max time kernel
121s
max time network
133s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 21:13

Target

3cfae4f15cd7fb9891056ea5621f432f.dll
Size

77KB
MD5

3cfae4f15cd7fb9891056ea5621f432f
SHA1

5f87b8ed26d6408faa00bb927e0819ba55d97d06
SHA256

5f1aa4e7f1f3f251973597757bc99488e1ff2f88405e76d0f6ebb907c1ea4bbc
SHA512

faed8515dfd18e0e6a2b382e397ebce41f24edb4df97b3240ed14f6c2a9bd030738b2ce67c93c8a8a3edf278d2c0b49c1dcd0d31628a372a09e86766f12e22ec
SSDEEP

1536:v/zg7GHMc55X9RR4iMDBnElLX1i0r0lhfvzts/vfg2wbmnkKAtEDeF8vY/Vy:v0KHt55X9RUwLli0mRvGo+nkKALF8Ac

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1092 wrote to memory of 1976	1092	rundll32.exe	28
PID 1092 wrote to memory of 1976	1092	rundll32.exe	28
PID 1092 wrote to memory of 1976	1092	rundll32.exe	28
PID 1092 wrote to memory of 1976	1092	rundll32.exe	28
PID 1092 wrote to memory of 1976	1092	rundll32.exe	28
PID 1092 wrote to memory of 1976	1092	rundll32.exe	28
PID 1092 wrote to memory of 1976	1092	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3cfae4f15cd7fb9891056ea5621f432f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1092
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3cfae4f15cd7fb9891056ea5621f432f.dll,#1
  2⤵
  PID:1976

memory/1976-0-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/1976-1-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/1976-2-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download