cb6a774293d7bb629df4618330357d107a00b12e24c7ae20df359c45373310dd

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 20:42

Target

3c1515fe1f52a61f4bbea983508e1b48.dll
Size

178KB
MD5

3c1515fe1f52a61f4bbea983508e1b48
SHA1

df02bcdd1fb3f2f99b6165423e82038e603160d5
SHA256

cb6a774293d7bb629df4618330357d107a00b12e24c7ae20df359c45373310dd
SHA512

60219422664da4e546725dba4ba2163e5dc846c2c31f7e4389449692e3ce2124c08b519ef171be859c596863682b7b588df6fa3483e9dd31b2d3717f1b170bc1
SSDEEP

3072:TG4jo4/UVsWbKl5xG8/gaKMaQpUu03cM/wQU0DkAq8uwCj:5oGl5xXIaKYU3c4w4k

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 2224	2088	rundll32.exe	28
PID 2088 wrote to memory of 2224	2088	rundll32.exe	28
PID 2088 wrote to memory of 2224	2088	rundll32.exe	28
PID 2088 wrote to memory of 2224	2088	rundll32.exe	28
PID 2088 wrote to memory of 2224	2088	rundll32.exe	28
PID 2088 wrote to memory of 2224	2088	rundll32.exe	28
PID 2088 wrote to memory of 2224	2088	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3c1515fe1f52a61f4bbea983508e1b48.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3c1515fe1f52a61f4bbea983508e1b48.dll,#1
  2⤵
  PID:2224

memory/2224-0-0x00000000006B0000-0x00000000006D9000-memory.dmp

Filesize
164KB

Download
memory/2224-1-0x0000000010000000-0x0000000010059000-memory.dmp

Filesize
356KB

Download