edfb4dbba9dfcc35942031468815f604d0a04ded79b0872f14aff6f51faed43e

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01/01/2024, 10:00

Target

3c8f6d0c77309ecced7ae3efd472eb4a.dll
Size

33KB
MD5

3c8f6d0c77309ecced7ae3efd472eb4a
SHA1

32d589ad80fd6a6c850d82101a48064309f122bc
SHA256

edfb4dbba9dfcc35942031468815f604d0a04ded79b0872f14aff6f51faed43e
SHA512

e0c9ee36f7d894c3100a137400d7e5d43dde7907714994981828c849a8438164499da81770bd41f93c967a664aee4b33011ea386cd36295d558f696efdbf64ec
SSDEEP

768:EReSZXXIvhzkZW4dyJ56ShX895UAJZNvxwA9vuJ:ERD4v2dyJ5lsUAJZNvx19vi

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 2432	2360	rundll32.exe	16
PID 2360 wrote to memory of 2432	2360	rundll32.exe	16
PID 2360 wrote to memory of 2432	2360	rundll32.exe	16
PID 2360 wrote to memory of 2432	2360	rundll32.exe	16
PID 2360 wrote to memory of 2432	2360	rundll32.exe	16
PID 2360 wrote to memory of 2432	2360	rundll32.exe	16
PID 2360 wrote to memory of 2432	2360	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3c8f6d0c77309ecced7ae3efd472eb4a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3c8f6d0c77309ecced7ae3efd472eb4a.dll,#1
  2⤵
  PID:2432

memory/2432-1-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download
memory/2432-4-0x00000000000B0000-0x00000000000B6000-memory.dmp

Filesize
24KB

Download
memory/2432-3-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download
memory/2432-2-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download
memory/2432-0-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download