c6fc14f95e87659fc31d96ea8660d237c80bc31daefc6bb4c08cb7f7d8383082

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
07/03/2024, 09:08

Target

b85bb3699de180ca3f4da3002fec92f6.dll
Size

412KB
MD5

b85bb3699de180ca3f4da3002fec92f6
SHA1

0274b5488ddade07fd03787de225805715671525
SHA256

c6fc14f95e87659fc31d96ea8660d237c80bc31daefc6bb4c08cb7f7d8383082
SHA512

3bade1e4f3be467ed5e17e07eca46c0914b24d2f468d2ae2732b7607e2a0a5d378ed6dfb11e7de0bfdc0beb4141b1e5cdb211ebd118b5540d7ad15e2ac078feb
SSDEEP

6144:wj44g1FPC0iApWfHoHPKkdM1Kb0jHoOhVaIYyHU/cYrbmLYHTInKOtGSVX:wE15CKUHoBN0zoO73Y7cYrbnHTIndPh

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 1536	3064	rundll32.exe	28
PID 3064 wrote to memory of 1536	3064	rundll32.exe	28
PID 3064 wrote to memory of 1536	3064	rundll32.exe	28
PID 3064 wrote to memory of 1536	3064	rundll32.exe	28
PID 3064 wrote to memory of 1536	3064	rundll32.exe	28
PID 3064 wrote to memory of 1536	3064	rundll32.exe	28
PID 3064 wrote to memory of 1536	3064	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b85bb3699de180ca3f4da3002fec92f6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b85bb3699de180ca3f4da3002fec92f6.dll,#1
  2⤵
  PID:1536

memory/1536-0-0x00000000009A0000-0x0000000000A07000-memory.dmp

Filesize
412KB

Download
memory/1536-1-0x0000000075750000-0x0000000075860000-memory.dmp

Filesize
1.1MB

Download
memory/1536-2-0x0000000000A10000-0x0000000000A7A000-memory.dmp

Filesize
424KB

Download
memory/1536-5-0x0000000000A10000-0x0000000000A7A000-memory.dmp

Filesize
424KB

Download
memory/1536-6-0x0000000075750000-0x0000000075860000-memory.dmp

Filesize
1.1MB

Download