65d64ef8ed33bb1d021dcbe0db9481c816f8b557fdc0bcaae85dbc4e8d3c8b84

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 20:51

Target

3c50685b6cb7ef7dda95fbe882d0632c.dll
Size

141KB
MD5

3c50685b6cb7ef7dda95fbe882d0632c
SHA1

515e5c14ac7b6c6723f4f1b886cb748972c6c2f2
SHA256

65d64ef8ed33bb1d021dcbe0db9481c816f8b557fdc0bcaae85dbc4e8d3c8b84
SHA512

e86900d0888c0779e85eb240716aeb952bb02bec94f225befa1b90d86306ec7ba0f726e8254110430e57b172bcc7e1de6af8daa88de38660609716e49ca57ebb
SSDEEP

3072:RECAJhkdOP17s/qaOi08OwyHxcnZGCCXl11PllV1V:REvgOP17s/F08OaoCC1vl1V

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 2912	1736	rundll32.exe	28
PID 1736 wrote to memory of 2912	1736	rundll32.exe	28
PID 1736 wrote to memory of 2912	1736	rundll32.exe	28
PID 1736 wrote to memory of 2912	1736	rundll32.exe	28
PID 1736 wrote to memory of 2912	1736	rundll32.exe	28
PID 1736 wrote to memory of 2912	1736	rundll32.exe	28
PID 1736 wrote to memory of 2912	1736	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3c50685b6cb7ef7dda95fbe882d0632c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3c50685b6cb7ef7dda95fbe882d0632c.dll,#1
  2⤵
  PID:2912