1ffb1b0431485ea09005bc51d2e50a354b0fe30c99ca50d0a8d3e5a329e83659

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
03/01/2024, 21:30

Target

3f12b562e32b6de257f7a4a2eb7ccd4b.dll
Size

104KB
MD5

3f12b562e32b6de257f7a4a2eb7ccd4b
SHA1

27755f973622e52447932034daf5ec42a3c08251
SHA256

1ffb1b0431485ea09005bc51d2e50a354b0fe30c99ca50d0a8d3e5a329e83659
SHA512

3365a802a62de27fba0ca3397ea493d968521d705568e7fc7acf588806d5c65d040c59e5bd482aa7e6b8fefedaaac2437da4ec2b2423933c094f278838d225f1
SSDEEP

768:amzMKn+EylcLLTpvMbX8lmKEN3lt2gJVBl69CzmF+ZU9QZU9hFnN89:am4K+JETp66mKA3l9Bl2CSF+zqFnN6

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 804 wrote to memory of 2936	804	rundll32.exe	28
PID 804 wrote to memory of 2936	804	rundll32.exe	28
PID 804 wrote to memory of 2936	804	rundll32.exe	28
PID 804 wrote to memory of 2936	804	rundll32.exe	28
PID 804 wrote to memory of 2936	804	rundll32.exe	28
PID 804 wrote to memory of 2936	804	rundll32.exe	28
PID 804 wrote to memory of 2936	804	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3f12b562e32b6de257f7a4a2eb7ccd4b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:804
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3f12b562e32b6de257f7a4a2eb7ccd4b.dll,#1
  2⤵
  PID:2936