563d0e670d8ff0fb4cdf870452b30e945ef34c01f9c4d41a52d44e0066d2ce6b

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 16:31

Target

Archivarius 3000/A3.dll
Size

163KB
MD5

0c80f5bcc11f67b5b5e036d9539f4432
SHA1

12f143eca39d39bd301fd0f7d5e9b79ed034597d
SHA256

529a2e81425b1c0fa76fb376d856f6650bfc714d6216dd8c6499bccaaaed871a
SHA512

a8b5544907f05ebe899270eff93b74464963f41c4beeab5c87f3eb509a9495005016d8799f7b32df330e8044e089fdb258650d99875b779255b5bba3431664c6
SSDEEP

3072:cIXzx+zxlmGEH3b6sAXMkIf/4a8ehLsdYEGrBQPF1IKnz2ImG/iLQLqhvCOJUDGZ:cVfmJXN48/p8eikrKFiKnz2ImwiR3oS

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 2000	2368	rundll32.exe	28
PID 2368 wrote to memory of 2000	2368	rundll32.exe	28
PID 2368 wrote to memory of 2000	2368	rundll32.exe	28
PID 2368 wrote to memory of 2000	2368	rundll32.exe	28
PID 2368 wrote to memory of 2000	2368	rundll32.exe	28
PID 2368 wrote to memory of 2000	2368	rundll32.exe	28
PID 2368 wrote to memory of 2000	2368	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Archivarius 3000\A3.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Archivarius 3000\A3.dll",#1
  2⤵
  PID:2000

memory/2000-0-0x0000000000210000-0x00000000002B4000-memory.dmp

Filesize
656KB

Download