b2daa446ad1b606843bff4bac27d1a69fd4c164ba0c23f2b62e184a21d7ea43e

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 13:14

Target

3787339ebdff657bcd67f452f3b886f0.dll
Size

99KB
MD5

3787339ebdff657bcd67f452f3b886f0
SHA1

17162005ea07c949709330400b74260ac8830153
SHA256

b2daa446ad1b606843bff4bac27d1a69fd4c164ba0c23f2b62e184a21d7ea43e
SHA512

3d2c04f9832fe850fa05ec13be596d0c9ea64b3cc1fafb4428c000597812fac9be6b5848f3ab78e7d6050785749c19ac6f3cbf6dd3d5929701c8081897d1bd72
SSDEEP

1536:5YMXz87wxBlbA4nazhdExD32+6f4OCFYdAcOohKbz0TrIKC+IBc5HgUfOeeb:5pM4nazhd06fJOpUKbwTzRW+HgcOe

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2536	2184	rundll32.exe	28
PID 2184 wrote to memory of 2536	2184	rundll32.exe	28
PID 2184 wrote to memory of 2536	2184	rundll32.exe	28
PID 2184 wrote to memory of 2536	2184	rundll32.exe	28
PID 2184 wrote to memory of 2536	2184	rundll32.exe	28
PID 2184 wrote to memory of 2536	2184	rundll32.exe	28
PID 2184 wrote to memory of 2536	2184	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3787339ebdff657bcd67f452f3b886f0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3787339ebdff657bcd67f452f3b886f0.dll,#1
  2⤵
  PID:2536

memory/2536-0-0x0000000010000000-0x0000000010042000-memory.dmp

Filesize
264KB

Download
memory/2536-1-0x0000000010000000-0x0000000010042000-memory.dmp

Filesize
264KB

Download
memory/2536-2-0x0000000000250000-0x0000000000267000-memory.dmp

Filesize
92KB

Download