d9d8c88aee751b12b2d7f47a32bda3c86867e711aeb473e72222f17cfbc4293e

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/10/2022, 20:02

Target

2004-57-0x00000000001E0000-0x0000000000202000-memory.dll
Size

136KB
MD5

9044a04e0ebe337ba58b77dc05022cdd
SHA1

2c325c63c6a5a9ca15bc443e403553138e1cfc92
SHA256

d9d8c88aee751b12b2d7f47a32bda3c86867e711aeb473e72222f17cfbc4293e
SHA512

d41cda072bc01728dd50fa4ffe7ad6f214b867a7525c1cb32ed76d9b607641fa094b7e2f6022dfbd9705127ad8761d23ded176ca7e6f675af17a440689395147
SSDEEP

3072:jqSkfjVMD6pChvtxrpwA+fJddHzMTBfdXYKB:jAVM+ohvtVpF+fJPHzMTB1IKB

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1836 wrote to memory of 340	1836	rundll32.exe	27
PID 1836 wrote to memory of 340	1836	rundll32.exe	27
PID 1836 wrote to memory of 340	1836	rundll32.exe	27
PID 1836 wrote to memory of 340	1836	rundll32.exe	27
PID 1836 wrote to memory of 340	1836	rundll32.exe	27
PID 1836 wrote to memory of 340	1836	rundll32.exe	27
PID 1836 wrote to memory of 340	1836	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2004-57-0x00000000001E0000-0x0000000000202000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1836
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2004-57-0x00000000001E0000-0x0000000000202000-memory.dll,#1
  2⤵
  PID:340

memory/340-55-0x0000000075771000-0x0000000075773000-memory.dmp

Filesize
8KB

Download