ee2994270b42614eb65db99369dbe610a5ddaba06322b56c15280d1d5ec76019

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/04/2024, 02:07

Target

$TEMPfolder/ortmp/freebl3.dll
Size

296KB
MD5

a3c1cba32232b8c28d3551fb78307058
SHA1

0c07aee705c8e10d4b4cb9af43f0f6722e7f4c3a
SHA256

ee912f5dcb516747d4ab5497e4a61cfbc413efab61fafbca6646a320cf07f601
SHA512

c7f7bb85db1d1a15deb9dc862f7eefa19203bdf22b582ea0f31973dbba9abbeab7fb7babd32c2037f7c9411c747c7fb91762ef18cf1642ef1edd3072f1875765
SSDEEP

6144:y6uQXzEKoFU1cMeRX+wsE0qMbPpErdJIkE2qwQqqDL67PXGHrIrm:TuQXzEVVsE0qgxE5JIkPVVqn6jIp

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 3068	2168	rundll32.exe	28
PID 2168 wrote to memory of 3068	2168	rundll32.exe	28
PID 2168 wrote to memory of 3068	2168	rundll32.exe	28
PID 2168 wrote to memory of 3068	2168	rundll32.exe	28
PID 2168 wrote to memory of 3068	2168	rundll32.exe	28
PID 2168 wrote to memory of 3068	2168	rundll32.exe	28
PID 2168 wrote to memory of 3068	2168	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMPfolder\ortmp\freebl3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMPfolder\ortmp\freebl3.dll,#1
  2⤵
  PID:3068