10b12baf4e612431b9b0c797b6848be51988e11fb0c7de0f98e3d8db103cabc2

Analysis

max time kernel
43s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
12-09-2022 17:15

Target

1696-57-0x00000000001A0000-0x00000000001C2000-memory.dll
Size

136KB
MD5

710cefabbf5b7b6082c625d84d109652
SHA1

97c3b5fa47558fdbbb2b04a6fd75e6d1a400e64d
SHA256

10b12baf4e612431b9b0c797b6848be51988e11fb0c7de0f98e3d8db103cabc2
SHA512

f0e3865143d2de29393646400f998b832aca8db43361f2c66609690e3a725ae4030b44df4a4bac682624b7c995d0e50048145b68bd8eb94704138c24f95b2f09
SSDEEP

3072:1QTd6ZaT+KB2wztNutAZJFn3g8TBfVvwJ:OcZaTRMwzt8uZJN3g8TBtvwJ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1640 wrote to memory of 980	1640	rundll32.exe	rundll32.exe
PID 1640 wrote to memory of 980	1640	rundll32.exe	rundll32.exe
PID 1640 wrote to memory of 980	1640	rundll32.exe	rundll32.exe
PID 1640 wrote to memory of 980	1640	rundll32.exe	rundll32.exe
PID 1640 wrote to memory of 980	1640	rundll32.exe	rundll32.exe
PID 1640 wrote to memory of 980	1640	rundll32.exe	rundll32.exe
PID 1640 wrote to memory of 980	1640	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1696-57-0x00000000001A0000-0x00000000001C2000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1640

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1696-57-0x00000000001A0000-0x00000000001C2000-memory.dll,#1
2⤵
PID:980

memory/980-54-0x0000000000000000-mapping.dmp

Download
memory/980-55-0x0000000075811000-0x0000000075813000-memory.dmp

Filesize
8KB

Download