8df05e255ce1317db4abb9d84c00917f23d3d0ef9ca0bde0cd05e1d7d50efed6

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/06/2024, 06:06

Target

$TEMPfolder/DomriuAdoej/freebl3.dll
Size

296KB
MD5

a3c1cba32232b8c28d3551fb78307058
SHA1

0c07aee705c8e10d4b4cb9af43f0f6722e7f4c3a
SHA256

ee912f5dcb516747d4ab5497e4a61cfbc413efab61fafbca6646a320cf07f601
SHA512

c7f7bb85db1d1a15deb9dc862f7eefa19203bdf22b582ea0f31973dbba9abbeab7fb7babd32c2037f7c9411c747c7fb91762ef18cf1642ef1edd3072f1875765
SSDEEP

6144:y6uQXzEKoFU1cMeRX+wsE0qMbPpErdJIkE2qwQqqDL67PXGHrIrm:TuQXzEVVsE0qgxE5JIkPVVqn6jIp

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 2236	2012	rundll32.exe	28
PID 2012 wrote to memory of 2236	2012	rundll32.exe	28
PID 2012 wrote to memory of 2236	2012	rundll32.exe	28
PID 2012 wrote to memory of 2236	2012	rundll32.exe	28
PID 2012 wrote to memory of 2236	2012	rundll32.exe	28
PID 2012 wrote to memory of 2236	2012	rundll32.exe	28
PID 2012 wrote to memory of 2236	2012	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMPfolder\DomriuAdoej\freebl3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMPfolder\DomriuAdoej\freebl3.dll,#1
  2⤵
  PID:2236