54535aab522ce0407ebf574ade0e3406c69b47dc44c3abfe19c5d9b8dd5e0cc3

Analysis

max time kernel
45s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
14-09-2022 17:08

Target

1148-57-0x00000000001D0000-0x00000000001F2000-memory.dll
Size

136KB
MD5

6ece39c18d8ebc57f7747bc87bf7f3ed
SHA1

26be145093e29167368c9864f1a4a553125cd87c
SHA256

54535aab522ce0407ebf574ade0e3406c69b47dc44c3abfe19c5d9b8dd5e0cc3
SHA512

40d4fa581885892db851a6daeb9891eae1159e62906743b21c1bda1579646e6de57beb01bdda83dd63601fb9bfc38b8068fabb39a7a68d32b36260e8633fbd9f
SSDEEP

3072:zeM+kgPKMVh7C7Fek20xAtJnZ1vITBfZFMaFAu:1IKshe7FekX6tJZ1vITBxmIJ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1576 wrote to memory of 584	1576	rundll32.exe	rundll32.exe
PID 1576 wrote to memory of 584	1576	rundll32.exe	rundll32.exe
PID 1576 wrote to memory of 584	1576	rundll32.exe	rundll32.exe
PID 1576 wrote to memory of 584	1576	rundll32.exe	rundll32.exe
PID 1576 wrote to memory of 584	1576	rundll32.exe	rundll32.exe
PID 1576 wrote to memory of 584	1576	rundll32.exe	rundll32.exe
PID 1576 wrote to memory of 584	1576	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1148-57-0x00000000001D0000-0x00000000001F2000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1576

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1148-57-0x00000000001D0000-0x00000000001F2000-memory.dll,#1
2⤵
PID:584

memory/584-54-0x0000000000000000-mapping.dmp

Download
memory/584-55-0x0000000075B11000-0x0000000075B13000-memory.dmp

Filesize
8KB

Download