1b64bbad7b0ebca04900f3bbcd627d14cf8e46cbc147af6bb8d9aa021d1441e6

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
27-10-2022 20:46

Target

1080-99-0x0000000001EA0000-0x0000000001EC9000-memory.dll
Size

164KB
MD5

1861c566e2ccb6f1eb748f34da47ecb6
SHA1

1d0bb50b20748d13b80e9536d93b6b7483a9d378
SHA256

1b64bbad7b0ebca04900f3bbcd627d14cf8e46cbc147af6bb8d9aa021d1441e6
SHA512

281e1965901fb2789cc042ec021269236c2ec651da77632f8cb40d1604f13e508e0683d0d37d630b72f6bc01112d7e5f16f326cacc512dbc2aa38528c494f618
SSDEEP

3072:K09u9KGxHUdb8H6abAtJxM9aHTBflnyHAO/ya:o9Ki0db8BMtJe9aHTB9yHj/

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 992 wrote to memory of 928	992	rundll32.exe	rundll32.exe
PID 992 wrote to memory of 928	992	rundll32.exe	rundll32.exe
PID 992 wrote to memory of 928	992	rundll32.exe	rundll32.exe
PID 992 wrote to memory of 928	992	rundll32.exe	rundll32.exe
PID 992 wrote to memory of 928	992	rundll32.exe	rundll32.exe
PID 992 wrote to memory of 928	992	rundll32.exe	rundll32.exe
PID 992 wrote to memory of 928	992	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1080-99-0x0000000001EA0000-0x0000000001EC9000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:992

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1080-99-0x0000000001EA0000-0x0000000001EC9000-memory.dll,#1
2⤵
PID:928

memory/928-54-0x0000000000000000-mapping.dmp

Download
memory/928-55-0x0000000076561000-0x0000000076563000-memory.dmp

Filesize
8KB

Download