cb84989e7f2e41ccfe682d8e3926700fed0713ae6d3dff904a523786777778a4

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
01/01/2024, 00:33

Target

3b761bff632f09fd83d85d139aab7d0e.dll
Size

83KB
MD5

3b761bff632f09fd83d85d139aab7d0e
SHA1

46504507efb128233781a820c08ab681fedd6fa7
SHA256

cb84989e7f2e41ccfe682d8e3926700fed0713ae6d3dff904a523786777778a4
SHA512

5e46bcb957cfa66f6452f2394b8a6f49e7b68b663116df6b621896f9d98173481efce6a92d2b63b9ed00e44b3661854c873faae5cbec9db1315293441eb9c413
SSDEEP

1536:k/vI1FLboSyo9yZrZVfYyERyzLtnipMrmD/lLq9pqk6wtfy/PZ7s:k/v8o69WrZG0Bni1hEGw

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 2320	2188	rundll32.exe	16
PID 2188 wrote to memory of 2320	2188	rundll32.exe	16
PID 2188 wrote to memory of 2320	2188	rundll32.exe	16
PID 2188 wrote to memory of 2320	2188	rundll32.exe	16
PID 2188 wrote to memory of 2320	2188	rundll32.exe	16
PID 2188 wrote to memory of 2320	2188	rundll32.exe	16
PID 2188 wrote to memory of 2320	2188	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b761bff632f09fd83d85d139aab7d0e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b761bff632f09fd83d85d139aab7d0e.dll,#1
  2⤵
  PID:2320

memory/2320-2-0x0000000010000000-0x000000001002C000-memory.dmp

Filesize
176KB

Download
memory/2320-1-0x0000000010000000-0x000000001002C000-memory.dmp

Filesize
176KB

Download
memory/2320-0-0x0000000010000000-0x000000001002C000-memory.dmp

Filesize
176KB

Download