5b22b4abf1b37080e79d6293b645695caba5b30a6a3680455107595fdc86a818

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01/01/2024, 07:22

Target

3c3ca1809b0af6efa84aa30ad0381229.dll
Size

48KB
MD5

3c3ca1809b0af6efa84aa30ad0381229
SHA1

ebfeebbf235afcc926f40bc80a21674722b11c03
SHA256

5b22b4abf1b37080e79d6293b645695caba5b30a6a3680455107595fdc86a818
SHA512

91aa50d5648b7fd1c228910ed346d3185ad589fab867a9e5d0270f64e7ccc67669795d8397d93a8a0c771f87bb7eb30370c73f770694c0d55ed1ea51d82f7f64
SSDEEP

768:p7lcEG6WPmby9NQUL2nSNynZQSCnBRILWrRaBbGz14RYKgr4sK0:BAme9Nm0yeBBReW8bGz14uLK0

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2548	2232	rundll32.exe	28
PID 2232 wrote to memory of 2548	2232	rundll32.exe	28
PID 2232 wrote to memory of 2548	2232	rundll32.exe	28
PID 2232 wrote to memory of 2548	2232	rundll32.exe	28
PID 2232 wrote to memory of 2548	2232	rundll32.exe	28
PID 2232 wrote to memory of 2548	2232	rundll32.exe	28
PID 2232 wrote to memory of 2548	2232	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3c3ca1809b0af6efa84aa30ad0381229.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3c3ca1809b0af6efa84aa30ad0381229.dll,#1
  2⤵
  PID:2548

memory/2548-0-0x0000000010000000-0x000000001002D000-memory.dmp

Filesize
180KB

Download
memory/2548-1-0x0000000010000000-0x000000001002D000-memory.dmp

Filesize
180KB

Download