cffbc4795d736a12f090ddfdd64693c86a1f6e0234c5d7fe2c429ec3fe27ec0b

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 15:53

Target

3a7661229406c29739735dea349ae046.dll
Size

28KB
MD5

3a7661229406c29739735dea349ae046
SHA1

83924d8bdfa850dfe47911f1f64cfc02252077ea
SHA256

cffbc4795d736a12f090ddfdd64693c86a1f6e0234c5d7fe2c429ec3fe27ec0b
SHA512

be04a6cff9e8cf50618ea634f845f588c09ba25d8b553f49d1cac9c37aefa3972897c7e04a659a0cfc05f6135072a6881836daef175677e2e8545485ca63db49
SSDEEP

384:hwED5ZqStySv8sniTF7AB1NACPQ3F22qbq/Upct5J:hx5htLv8siTlUzi22yqcat5

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 2344	2732	rundll32.exe	16
PID 2732 wrote to memory of 2344	2732	rundll32.exe	16
PID 2732 wrote to memory of 2344	2732	rundll32.exe	16
PID 2732 wrote to memory of 2344	2732	rundll32.exe	16
PID 2732 wrote to memory of 2344	2732	rundll32.exe	16
PID 2732 wrote to memory of 2344	2732	rundll32.exe	16
PID 2732 wrote to memory of 2344	2732	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3a7661229406c29739735dea349ae046.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3a7661229406c29739735dea349ae046.dll,#1
  2⤵
  PID:2344