b29e2c469f70a103817d3f8478c6aad29a3e9d633eeb218c99d68b158952e635

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
08-09-2022 19:51

Target

1500-58-0x0000000000A50000-0x0000000000A72000-memory.dll
Size

136KB
MD5

4f2dd55e61f9d46734ba1442090baedb
SHA1

a2690c1aa87769a2582947ad3c6a566983ab8071
SHA256

b29e2c469f70a103817d3f8478c6aad29a3e9d633eeb218c99d68b158952e635
SHA512

1e2f690743707b37e0d91bde8081db59c67a6dfdabe7259e0655e8e98c98831fc62d22832faebc1d00af0985325e251a5f6beebedd9a4efef113f76cab207dca
SSDEEP

3072:rysTDU+CO+nm18MRAGJhV1LsFTBfZlehr4K:3wpO+nmdaGJn1gFTBxchr

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1504 wrote to memory of 1628	1504	rundll32.exe	rundll32.exe
PID 1504 wrote to memory of 1628	1504	rundll32.exe	rundll32.exe
PID 1504 wrote to memory of 1628	1504	rundll32.exe	rundll32.exe
PID 1504 wrote to memory of 1628	1504	rundll32.exe	rundll32.exe
PID 1504 wrote to memory of 1628	1504	rundll32.exe	rundll32.exe
PID 1504 wrote to memory of 1628	1504	rundll32.exe	rundll32.exe
PID 1504 wrote to memory of 1628	1504	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1500-58-0x0000000000A50000-0x0000000000A72000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1504

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1500-58-0x0000000000A50000-0x0000000000A72000-memory.dll,#1
2⤵
PID:1628

memory/1628-54-0x0000000000000000-mapping.dmp

Download
memory/1628-55-0x0000000075ED1000-0x0000000075ED3000-memory.dmp

Filesize
8KB

Download