a3b5e0722576ace99b8537458bcae2147df09520caf11138a8a5e87c041b18c6

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
21/05/2024, 05:51

Target

dot3ui.dll
Size

326KB
MD5

8fbe98499adc541c63bb10b722da00d4
SHA1

a558e7b61b27cfc20569bbc1ddc33a5e9f541cb8
SHA256

a3b5e0722576ace99b8537458bcae2147df09520caf11138a8a5e87c041b18c6
SHA512

a97813d6e3ae35f1dcde0f8fe99247ca9918a8a675059ea46720c50ff80a51ae759146a9c36aa2a16205472cda48af843ead99bddd6431dc79bc13620ce4e354
SSDEEP

6144:9aH7jRyRt7h5wHj0vzGNo+13i3YaO70avg24In4vIMc8oIACENB/QN6MS:cbjc7Tcj5o+1S3YaO70avg24InscDB/y

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 1904	2424	rundll32.exe	28
PID 2424 wrote to memory of 1904	2424	rundll32.exe	28
PID 2424 wrote to memory of 1904	2424	rundll32.exe	28
PID 2424 wrote to memory of 1904	2424	rundll32.exe	28
PID 2424 wrote to memory of 1904	2424	rundll32.exe	28
PID 2424 wrote to memory of 1904	2424	rundll32.exe	28
PID 2424 wrote to memory of 1904	2424	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dot3ui.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dot3ui.dll,#1
  2⤵
  PID:1904