c38809cff06deb27896a1f30469c12c648e1ccbfb3058841cb619ccfff1fdbcb

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 22:45

Target

3b413d97060e24d280dd0f4872b9b903.dll
Size

277KB
MD5

3b413d97060e24d280dd0f4872b9b903
SHA1

1cb71d9732b88e5644fde414e1317c93af9b4c7b
SHA256

c38809cff06deb27896a1f30469c12c648e1ccbfb3058841cb619ccfff1fdbcb
SHA512

587d99ef299d9292599eb205cc31e071669dabe6edfd240857cce13d0e5e101de0e5fadb15830cecae4fce240c80e12577a994c9a5971dd65013ab4fb250d862
SSDEEP

6144:pyl/zy8Orezu7I/mfzJGpgJina9Lcp9UBvkUPVOtjV/EAZ9Qt0ebGZqABySwAp8k:pO/zy88ezu6mfzJGpgJrTkUPViebSqVg

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 2112	1720	rundll32.exe	28
PID 1720 wrote to memory of 2112	1720	rundll32.exe	28
PID 1720 wrote to memory of 2112	1720	rundll32.exe	28
PID 1720 wrote to memory of 2112	1720	rundll32.exe	28
PID 1720 wrote to memory of 2112	1720	rundll32.exe	28
PID 1720 wrote to memory of 2112	1720	rundll32.exe	28
PID 1720 wrote to memory of 2112	1720	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b413d97060e24d280dd0f4872b9b903.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b413d97060e24d280dd0f4872b9b903.dll,#1
  2⤵
  PID:2112