c40dd0364e3b327849c68139e072db09b5f71ab38a8526865c47766a61f2364f

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/02/2024, 13:05

Target

a3db86ff8ec6a30e07ad7830d8663ef7.dll
Size

1005KB
MD5

a3db86ff8ec6a30e07ad7830d8663ef7
SHA1

41b669a530f9cb2a3a140bc6037f3292ef066b9e
SHA256

c40dd0364e3b327849c68139e072db09b5f71ab38a8526865c47766a61f2364f
SHA512

53f1bee877ca947458cd547c69ee73351e25e5a9dd86a0e45a765025f59d1eb221dd5f3f24fe20bd11dc9d179f50df5c3d319c090fc2b990b8fa15f48e2e5807
SSDEEP

3072:TQuZG/ZMiE61ouqY7dtACZrzNp/c3Wh4CyPuf5Vlxl+ROXReazAOF/uIAPX2hjik:EESt3rg3s4CyPuffLvseT/uZ4ji8CA5

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 2968	2292	rundll32.exe	28
PID 2292 wrote to memory of 2968	2292	rundll32.exe	28
PID 2292 wrote to memory of 2968	2292	rundll32.exe	28
PID 2292 wrote to memory of 2968	2292	rundll32.exe	28
PID 2292 wrote to memory of 2968	2292	rundll32.exe	28
PID 2292 wrote to memory of 2968	2292	rundll32.exe	28
PID 2292 wrote to memory of 2968	2292	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a3db86ff8ec6a30e07ad7830d8663ef7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a3db86ff8ec6a30e07ad7830d8663ef7.dll,#1
  2⤵
  PID:2968

memory/2968-0-0x00000000005C0000-0x00000000005DE000-memory.dmp

Filesize
120KB

Download
memory/2968-1-0x0000000010000000-0x00000000100FF000-memory.dmp

Filesize
1020KB

Download