2b06bad0d1b52df01d930cf8b39f50aeaa3e360be09e46d86e747b81ab3c2a86

Analysis

max time kernel
40s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
14-09-2022 14:07

Target

1948-57-0x0000000000260000-0x0000000000282000-memory.dll
Size

136KB
MD5

3dd467b9cde593b2e55fd5954342f743
SHA1

5539bc0f113eaa3f2c383d6d41b5652e1a186189
SHA256

2b06bad0d1b52df01d930cf8b39f50aeaa3e360be09e46d86e747b81ab3c2a86
SHA512

94b3baf79f9dd90f55b318141c297269b15ad65c89eb57f895ddc9dd4b05ff5ca2c9d02548995023457a287da9404df1b14f4024b8cb89573888446064866248
SSDEEP

3072:qhw4nPjx3ECKnkpXPPpq1yAXJQ1EHs4TBf9iIaFA6:aPjVEdnkpXPPAXXJ0EHs4TBVtIl

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1628 wrote to memory of 852	1628	rundll32.exe	rundll32.exe
PID 1628 wrote to memory of 852	1628	rundll32.exe	rundll32.exe
PID 1628 wrote to memory of 852	1628	rundll32.exe	rundll32.exe
PID 1628 wrote to memory of 852	1628	rundll32.exe	rundll32.exe
PID 1628 wrote to memory of 852	1628	rundll32.exe	rundll32.exe
PID 1628 wrote to memory of 852	1628	rundll32.exe	rundll32.exe
PID 1628 wrote to memory of 852	1628	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1948-57-0x0000000000260000-0x0000000000282000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1948-57-0x0000000000260000-0x0000000000282000-memory.dll,#1
  2⤵
  PID:852

memory/852-54-0x0000000000000000-mapping.dmp

Download
memory/852-55-0x0000000075ED1000-0x0000000075ED3000-memory.dmp

Filesize
8KB

Download