Analysis
-
max time kernel
4294180s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20220311-en -
submitted
23/03/2022, 07:06
Behavioral task
behavioral1
Sample
1664-56-0x0000000000170000-0x000000000017E000-memory.dll
Resource
win7-20220311-en
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
1664-56-0x0000000000170000-0x000000000017E000-memory.dll
Resource
win10v2004-en-20220113
0 signatures
0 seconds
General
-
Target
1664-56-0x0000000000170000-0x000000000017E000-memory.dll
-
Size
56KB
-
MD5
957bf145eb17dd1e80ffabfe9578de02
-
SHA1
ab657c6b586d17dec42482660bfcf06b3e546ae1
-
SHA256
2d54d23157e549d56edfa497620df75e4291413181f4883f91aecdfe9e38ae1a
-
SHA512
4b1a5c2288d4c8b2b6c401ee27a2fe94d080e246ea28b81fc4a78a8b94c386398f1dc04eea4894567cba514069baaae5ab208784b39b2842fe1323b15d19abf2
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1664 wrote to memory of 1488 1664 rundll32.exe 27 PID 1664 wrote to memory of 1488 1664 rundll32.exe 27 PID 1664 wrote to memory of 1488 1664 rundll32.exe 27 PID 1664 wrote to memory of 1488 1664 rundll32.exe 27 PID 1664 wrote to memory of 1488 1664 rundll32.exe 27 PID 1664 wrote to memory of 1488 1664 rundll32.exe 27 PID 1664 wrote to memory of 1488 1664 rundll32.exe 27
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1664-56-0x0000000000170000-0x000000000017E000-memory.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1664-56-0x0000000000170000-0x000000000017E000-memory.dll,#12⤵PID:1488
-