c174d3666b09b6f25bb2a4a4dd1051b50a1fc33baaf601c539af5948c1bd8909

Analysis

max time kernel
27s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
09-12-2022 10:23

Target

2036-113-0x0000000010000000-0x0000000010B6B000-memory.dll
Size

11.4MB
MD5

5602bcd36cc1fbc167b322a00142e1ee
SHA1

da210f01b513d92a4046f951280aaa56b99917cf
SHA256

c174d3666b09b6f25bb2a4a4dd1051b50a1fc33baaf601c539af5948c1bd8909
SHA512

c70efab057fb99953783e5d16aadbdeb3d9580dbf3427b70cbdbd75e9cbc2430f1668a1c053cf5dcf87f4c24f01124c95812cdf986dc97d33d5c3137d3c53f34
SSDEEP

196608:KGGb6IDktU3uYOQAahryWXMM3ksPqmzcl+LG314Hujb7KgkYCbGNBmHTE:KG+6kp51kUMMUON+2HBb

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2036 wrote to memory of 2032	2036	rundll32.exe	rundll32.exe
PID 2036 wrote to memory of 2032	2036	rundll32.exe	rundll32.exe
PID 2036 wrote to memory of 2032	2036	rundll32.exe	rundll32.exe
PID 2036 wrote to memory of 2032	2036	rundll32.exe	rundll32.exe
PID 2036 wrote to memory of 2032	2036	rundll32.exe	rundll32.exe
PID 2036 wrote to memory of 2032	2036	rundll32.exe	rundll32.exe
PID 2036 wrote to memory of 2032	2036	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2036-113-0x0000000010000000-0x0000000010B6B000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2036

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2036-113-0x0000000010000000-0x0000000010B6B000-memory.dll,#1
2⤵
PID:2032

memory/2032-54-0x0000000000000000-mapping.dmp

Download
memory/2032-55-0x0000000076381000-0x0000000076383000-memory.dmp

Filesize
8KB

Download