ec60beee43104003bc410371ae1ef8e846e17ff5733556dbd8e7acae68058200

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
26/04/2024, 15:35

Target

bin/freebl3.dll
Size

314KB
MD5

f474dd91bb12f230209ec3163ce7e6c4
SHA1

04ff682e527a1c132f73bd836b7880dfa1128528
SHA256

f63b2cab4b77ac63a1beca66872a991e1f8233f2c513d42460dbf28c733b138c
SHA512

01f1feaacda301b013f5e097fa5816b0075b7389ee0522e8fe350802093f6cdfe6ade24ff2a0350896b333e44a77901bbcead85f8cf98bfa91fb110c18adbfee
SSDEEP

6144:rYq6WFCT7yIFyGre4gqvkeZEcoE9OhFPs3ivxVu0yUzHjp9AkVliqqDL687PXGHe:r5i7JlgqvkeZEcocOADUflHXqn6sIWB

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 2252	2276	rundll32.exe	28
PID 2276 wrote to memory of 2252	2276	rundll32.exe	28
PID 2276 wrote to memory of 2252	2276	rundll32.exe	28
PID 2276 wrote to memory of 2252	2276	rundll32.exe	28
PID 2276 wrote to memory of 2252	2276	rundll32.exe	28
PID 2276 wrote to memory of 2252	2276	rundll32.exe	28
PID 2276 wrote to memory of 2252	2276	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\freebl3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\freebl3.dll,#1
  2⤵
  PID:2252