72758ae442bd0a1d3ede02a04733f7d3bfb2bc079ba3f7843bfe35082c80fcfd

Analysis

max time kernel
48s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
14-09-2022 17:25

Target

1960-57-0x0000000000120000-0x0000000000142000-memory.dll
Size

136KB
MD5

4620b5c343c62f11077e056d0f5b8d1d
SHA1

aeb83018eafea9da43b4d6f358d858f9afc45a5a
SHA256

72758ae442bd0a1d3ede02a04733f7d3bfb2bc079ba3f7843bfe35082c80fcfd
SHA512

db1cb12fea13595f7c99099a23e9f6bd396aa69b5090a773ad0d560d359ffd237eeb2e3c8dbcf1e50f4899deaf7d232d4b1ad97cb58d491911caf9fdf745a084
SSDEEP

1536:i05x1lQyRClYCZwwaoF8mLspYBGBAT5KJ9wmAayeIOFnToIfFn4egrzMh:i02HJaWHLk62AwJqm3FtTBfF4eph

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1720 wrote to memory of 996	1720	rundll32.exe	rundll32.exe
PID 1720 wrote to memory of 996	1720	rundll32.exe	rundll32.exe
PID 1720 wrote to memory of 996	1720	rundll32.exe	rundll32.exe
PID 1720 wrote to memory of 996	1720	rundll32.exe	rundll32.exe
PID 1720 wrote to memory of 996	1720	rundll32.exe	rundll32.exe
PID 1720 wrote to memory of 996	1720	rundll32.exe	rundll32.exe
PID 1720 wrote to memory of 996	1720	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1960-57-0x0000000000120000-0x0000000000142000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1720

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1960-57-0x0000000000120000-0x0000000000142000-memory.dll,#1
2⤵
PID:996

memory/996-54-0x0000000000000000-mapping.dmp

Download
memory/996-55-0x00000000757A1000-0x00000000757A3000-memory.dmp

Filesize
8KB

Download