1cafa05278b9193e818cd578e01511fce5767e8755781722d1779cceb30405b7

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
19/12/2022, 13:55

Target

1260-137-0x0000000000AD0000-0x0000000000B07000-memory.dll
Size

220KB
MD5

ce33471868bae74150f0ce3a7f0aac51
SHA1

101adbb952236e2fcc92f99102c4e498c3a0aaf8
SHA256

1cafa05278b9193e818cd578e01511fce5767e8755781722d1779cceb30405b7
SHA512

3b20bc6870315bfcf0511546b4c9764c540d37007f1abcad8311518074327297920fd868476c95f899b4d94f43acc43069dcfefa9ae21603f79a8d67dd8876bd
SSDEEP

6144:766Jk8IxXC3YSL2a1Wd7h00Lks1YarGR8rjXuqpjHI:2Uv0XyYmYvbLks1YarGR8OWjo

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1064 wrote to memory of 1036	1064	rundll32.exe	27
PID 1064 wrote to memory of 1036	1064	rundll32.exe	27
PID 1064 wrote to memory of 1036	1064	rundll32.exe	27
PID 1064 wrote to memory of 1036	1064	rundll32.exe	27
PID 1064 wrote to memory of 1036	1064	rundll32.exe	27
PID 1064 wrote to memory of 1036	1064	rundll32.exe	27
PID 1064 wrote to memory of 1036	1064	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1260-137-0x0000000000AD0000-0x0000000000B07000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1064
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1260-137-0x0000000000AD0000-0x0000000000B07000-memory.dll,#1
  2⤵
  PID:1036

memory/1036-55-0x0000000075BB1000-0x0000000075BB3000-memory.dmp

Filesize
8KB

Download
memory/1036-56-0x0000000010000000-0x0000000010041000-memory.dmp

Filesize
260KB

Download
memory/1036-57-0x0000000010000000-0x0000000010041000-memory.dmp

Filesize
260KB

Download