e49e903760e3fda37ce99f398ead49ff2075e7a1fd9c4070ef50a89cb8cf3252

Analysis

max time kernel
122s
max time network
150s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01-01-2024 02:56

Target

3bb4ff401a4a485cd7b9b12a62c86f0e.dll
Size

669KB
MD5

3bb4ff401a4a485cd7b9b12a62c86f0e
SHA1

362d1352f1ff66efdd7f67182fc06b1aa9cd98b1
SHA256

e49e903760e3fda37ce99f398ead49ff2075e7a1fd9c4070ef50a89cb8cf3252
SHA512

8d8ccbab5098bacf949664afa6f6ddbcedc1b08229db143b2cb881353a4e2efb519b56dc96af161f48afa14b5798bdec11d593b3c4f45e2b3b61b452c0dddde8
SSDEEP

12288:aT40BhkfVIfQSlXK959rxQzk7+1IlBZWNWRJvdpcaXq2X6n0WSL6f:aTVBhk95Slsx77QIlBQNW/dpRXX60WSS

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 2604	1728	rundll32.exe	29
PID 1728 wrote to memory of 2604	1728	rundll32.exe	29
PID 1728 wrote to memory of 2604	1728	rundll32.exe	29
PID 1728 wrote to memory of 2604	1728	rundll32.exe	29
PID 1728 wrote to memory of 2604	1728	rundll32.exe	29
PID 1728 wrote to memory of 2604	1728	rundll32.exe	29
PID 1728 wrote to memory of 2604	1728	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3bb4ff401a4a485cd7b9b12a62c86f0e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3bb4ff401a4a485cd7b9b12a62c86f0e.dll,#1
  2⤵
  PID:2604