187570073544ada10dff94724a1f76c2565232d0a2c0448ee18fcdbe204d3010

Analysis

max time kernel
45s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
08-09-2022 12:20

Target

1988-58-0x00000000008B0000-0x00000000008D2000-memory.dll
Size

136KB
MD5

d3c9033085631f091c79ffe93e4521fc
SHA1

a153a63ae80f45a7639770bcc8e5bd92a43ff502
SHA256

187570073544ada10dff94724a1f76c2565232d0a2c0448ee18fcdbe204d3010
SHA512

2404bcd095bd5fa2b7ca4c0ad95ed808bef5344fb36e9aaefaa7fd968115ada6348188521f8b56fb92fc239d590006a0d6467971cd02b41b4c11287870d42fd1
SSDEEP

3072:usYXmPYG7NsZBkWs2ksvAT5JZrdRoTBf1P8aFA+:8OYG7kBRs2lY9JpdRoTBtEIZ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1440 wrote to memory of 872	1440	rundll32.exe	rundll32.exe
PID 1440 wrote to memory of 872	1440	rundll32.exe	rundll32.exe
PID 1440 wrote to memory of 872	1440	rundll32.exe	rundll32.exe
PID 1440 wrote to memory of 872	1440	rundll32.exe	rundll32.exe
PID 1440 wrote to memory of 872	1440	rundll32.exe	rundll32.exe
PID 1440 wrote to memory of 872	1440	rundll32.exe	rundll32.exe
PID 1440 wrote to memory of 872	1440	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1988-58-0x00000000008B0000-0x00000000008D2000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1440

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1988-58-0x00000000008B0000-0x00000000008D2000-memory.dll,#1
2⤵
PID:872

memory/872-54-0x0000000000000000-mapping.dmp

Download
memory/872-55-0x0000000076181000-0x0000000076183000-memory.dmp

Filesize
8KB

Download