ee7f6baf859028266bea5a5ce3d7c688987134209f2550b32e8dde3dfb195f17

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
14-09-2022 17:08

Target

1944-57-0x0000000000390000-0x00000000003B2000-memory.dll
Size

136KB
MD5

73d361c49d26f48f310e82d54d256525
SHA1

9afdb81c807bfd7ed3997c0f1ecdc0581e3d5142
SHA256

ee7f6baf859028266bea5a5ce3d7c688987134209f2550b32e8dde3dfb195f17
SHA512

90831c1cbda7b589a10dc49f257f551232472f2e35bafcb8651143b36049544dd00b4af4d15840296ec1e77b56883b5739901c3a5e43dc1188c813bee20d925f
SSDEEP

3072:niL0sP0RYFXy3FCo6en9AVJbdllATBfZZcaFAO:G0U0RYFi3FCorneVJxllATBxiIR

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1988 wrote to memory of 2008	1988	rundll32.exe	rundll32.exe
PID 1988 wrote to memory of 2008	1988	rundll32.exe	rundll32.exe
PID 1988 wrote to memory of 2008	1988	rundll32.exe	rundll32.exe
PID 1988 wrote to memory of 2008	1988	rundll32.exe	rundll32.exe
PID 1988 wrote to memory of 2008	1988	rundll32.exe	rundll32.exe
PID 1988 wrote to memory of 2008	1988	rundll32.exe	rundll32.exe
PID 1988 wrote to memory of 2008	1988	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1944-57-0x0000000000390000-0x00000000003B2000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1988

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1944-57-0x0000000000390000-0x00000000003B2000-memory.dll,#1
2⤵
PID:2008

memory/2008-54-0x0000000000000000-mapping.dmp

Download
memory/2008-55-0x00000000761F1000-0x00000000761F3000-memory.dmp

Filesize
8KB

Download