6bbe905cefacb0f2cfa7069e044b5f350de27ea15f0e9e4d9597192fa0ec91e5

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
25/02/2024, 08:30

Target

a3548bcea0290e9eb2102b71ed47dcd4.dll
Size

193KB
MD5

a3548bcea0290e9eb2102b71ed47dcd4
SHA1

0e2af8c0cee3b7e8266ce0fbf2829dff8795d880
SHA256

6bbe905cefacb0f2cfa7069e044b5f350de27ea15f0e9e4d9597192fa0ec91e5
SHA512

b085dd985598a79c879578003b603ef56b1bd551b189cf332ae653574acc95e0d7e487a196b0f9fe72bd5dde285e0f9939e7641958a5c58be0cd48bcbc3c6849
SSDEEP

3072:qp4jRcVu29j5Law8xUEPjxzNWnIWjSIs4c5EnOo9FoPWHOrLqlXDh8oDtqRjw3Xn:sCR49VLaw8xUEbxzyNJ9FCoDtqkXS

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 3068	2276	rundll32.exe	28
PID 2276 wrote to memory of 3068	2276	rundll32.exe	28
PID 2276 wrote to memory of 3068	2276	rundll32.exe	28
PID 2276 wrote to memory of 3068	2276	rundll32.exe	28
PID 2276 wrote to memory of 3068	2276	rundll32.exe	28
PID 2276 wrote to memory of 3068	2276	rundll32.exe	28
PID 2276 wrote to memory of 3068	2276	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a3548bcea0290e9eb2102b71ed47dcd4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a3548bcea0290e9eb2102b71ed47dcd4.dll,#1
  2⤵
  PID:3068

memory/3068-0-0x0000000000180000-0x00000000001BB000-memory.dmp

Filesize
236KB

Download