b3882d1babc41e8287e1b0abd0b1914c5554429e465af3aec346e6a35711495e

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 05:11

Target

2979afc8b324a96d936fedc9909b56f1.dll
Size

36KB
MD5

2979afc8b324a96d936fedc9909b56f1
SHA1

c74df15d53b87890c143d9b8ffd48e3139838968
SHA256

b3882d1babc41e8287e1b0abd0b1914c5554429e465af3aec346e6a35711495e
SHA512

3b5abe6e307907545239ca65f968c6a407f7282304a3e1ab61f809842dc6b9e678b0ebea9edc420848aa617071fd4d7c3550a36418964a7b3158595741e268ca
SSDEEP

768:DOBpuLcRbJ1N/ERvvgsNyIhxydgG567yxdrEJM:DOBgwrN/E2s8TWVerE+

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 688	2508	rundll32.exe	14
PID 2508 wrote to memory of 688	2508	rundll32.exe	14
PID 2508 wrote to memory of 688	2508	rundll32.exe	14
PID 2508 wrote to memory of 688	2508	rundll32.exe	14
PID 2508 wrote to memory of 688	2508	rundll32.exe	14
PID 2508 wrote to memory of 688	2508	rundll32.exe	14
PID 2508 wrote to memory of 688	2508	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2979afc8b324a96d936fedc9909b56f1.dll,#1
1⤵
PID:688

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2979afc8b324a96d936fedc9909b56f1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2508

memory/688-2-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download
memory/688-4-0x0000000000170000-0x0000000000175000-memory.dmp

Filesize
20KB

Download
memory/688-3-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download
memory/688-1-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download
memory/688-0-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download