7889ced971c1f79711eae1a160b54fd8f60a39670e5ee510fd86e2ea8366fbe9

Analysis

max time kernel
46s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
15-09-2022 15:20

Target

1932-56-0x00000000004B0000-0x00000000004D2000-memory.dll
Size

136KB
MD5

c47b12a9938251591412eb6bf6b77d72
SHA1

9bf63a356f6f48792bb872117b775d0b542068de
SHA256

7889ced971c1f79711eae1a160b54fd8f60a39670e5ee510fd86e2ea8366fbe9
SHA512

3781d260940bfcb83b3eb47b5407e0fa010c7de5607b570343f7667e1f66186dda86ff11b86389d05018985968df04dc42e18850abd47a06e63f895ca39ab8f6
SSDEEP

3072:6sphmPt6e24sgomOWRoAHJQ+dv88TBf1cI:JhmP0e24sg7tHJ5dU8TBtcI

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1680 wrote to memory of 2012	1680	rundll32.exe	rundll32.exe
PID 1680 wrote to memory of 2012	1680	rundll32.exe	rundll32.exe
PID 1680 wrote to memory of 2012	1680	rundll32.exe	rundll32.exe
PID 1680 wrote to memory of 2012	1680	rundll32.exe	rundll32.exe
PID 1680 wrote to memory of 2012	1680	rundll32.exe	rundll32.exe
PID 1680 wrote to memory of 2012	1680	rundll32.exe	rundll32.exe
PID 1680 wrote to memory of 2012	1680	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1932-56-0x00000000004B0000-0x00000000004D2000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1932-56-0x00000000004B0000-0x00000000004D2000-memory.dll,#1
  2⤵
  PID:2012

memory/2012-54-0x0000000000000000-mapping.dmp

Download
memory/2012-55-0x0000000075281000-0x0000000075283000-memory.dmp

Filesize
8KB

Download