a9d46fd1b5db26e16908b567824c90abe7b24cedc60b41eec71af08a8a256d71

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
14-09-2022 13:04

Target

1260-57-0x00000000001E0000-0x0000000000202000-memory.dll
Size

136KB
MD5

9e2f4109f75b9685b00faa2b123467b0
SHA1

8fbf8d3d5b26e73176fd2e2552c1a3b14ece1918
SHA256

a9d46fd1b5db26e16908b567824c90abe7b24cedc60b41eec71af08a8a256d71
SHA512

c4abfba1226a2e03d6fb84a8c06d254969b4727dcb1a7461b2368ae21452cf026afe281052c32f1aba00e6e48b5d96b4fdfae5e58c5d52da14bf32a84a2cf772
SSDEEP

1536:dcwD1lgihuOCZc4Kc1Eevt32Lsf5SBAwILluJV0is2OIOdnToIfdL4egrzkt:Owi9Kqvvt32LOKA4JeiH8VTBfd8e5t

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1696 wrote to memory of 944	1696	rundll32.exe	rundll32.exe
PID 1696 wrote to memory of 944	1696	rundll32.exe	rundll32.exe
PID 1696 wrote to memory of 944	1696	rundll32.exe	rundll32.exe
PID 1696 wrote to memory of 944	1696	rundll32.exe	rundll32.exe
PID 1696 wrote to memory of 944	1696	rundll32.exe	rundll32.exe
PID 1696 wrote to memory of 944	1696	rundll32.exe	rundll32.exe
PID 1696 wrote to memory of 944	1696	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1260-57-0x00000000001E0000-0x0000000000202000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1260-57-0x00000000001E0000-0x0000000000202000-memory.dll,#1
  2⤵
  PID:944

memory/944-54-0x0000000000000000-mapping.dmp

Download
memory/944-55-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download