462552677af3fda2adf23d937640e3628c034e561df5fd0eafdc3e3ea5bddb0a

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01-01-2024 15:53

Target

3d439e4da7b9a6288868bf23cdd04521.dll
Size

136KB
MD5

3d439e4da7b9a6288868bf23cdd04521
SHA1

57cbee1c1977101ae0c31f1e019f3bd837be5581
SHA256

462552677af3fda2adf23d937640e3628c034e561df5fd0eafdc3e3ea5bddb0a
SHA512

e3837cfaf26f6738152725c240222783bbec6b1c289787967fcd38cdd05d5cc9a6bc97dad586aad3b2262e99a886899b9b7fc3b859eff35ea771fe8eceeb38d0
SSDEEP

3072:IuDvZSn/3rmi/do5FVur0cX5/jVbwj+CDyafQJWzvX2orZfqb:IwW3q0mGr0cX5ZwjNDLwWzf3fq

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 776 wrote to memory of 3040	776	rundll32.exe	28
PID 776 wrote to memory of 3040	776	rundll32.exe	28
PID 776 wrote to memory of 3040	776	rundll32.exe	28
PID 776 wrote to memory of 3040	776	rundll32.exe	28
PID 776 wrote to memory of 3040	776	rundll32.exe	28
PID 776 wrote to memory of 3040	776	rundll32.exe	28
PID 776 wrote to memory of 3040	776	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3d439e4da7b9a6288868bf23cdd04521.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:776
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3d439e4da7b9a6288868bf23cdd04521.dll,#1
  2⤵
  PID:3040

memory/3040-0-0x0000000010000000-0x000000001002F000-memory.dmp

Filesize
188KB

Download
memory/3040-1-0x00000000001A0000-0x00000000001AA000-memory.dmp

Filesize
40KB

Download
memory/3040-5-0x00000000001A0000-0x00000000001AA000-memory.dmp

Filesize
40KB

Download
memory/3040-6-0x00000000001A0000-0x00000000001AA000-memory.dmp

Filesize
40KB

Download