c243df1a82755fa05aa27fbcead17863a78dee1874b6d575998dc67c60a59c83

Analysis

max time kernel
45s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
27/12/2022, 21:24

Target

1704-57-0x0000000000140000-0x0000000000162000-memory.dll
Size

136KB
MD5

919b138b7d6545735f91ab485bfbde37
SHA1

66de5e28ef0c86cfae6e15f6a21742125286c5fa
SHA256

c243df1a82755fa05aa27fbcead17863a78dee1874b6d575998dc67c60a59c83
SHA512

51e76ac08fa65f900c86d6a27ed42531fa5e72f09aab30203a4feff806e353cc362fa311bc9f341634b7ba28f49fa60ca36265c2541ad4326bc25cf434df1a60
SSDEEP

1536:MCf1pg43ZwsCJ28qerxgmtszKiSMQhABArbMJNq0ecUIOpnToIfp9cegrzst:MCmTqETtsxOgAkJA0L6BTBfpWept

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 944	1696	rundll32.exe	27
PID 1696 wrote to memory of 944	1696	rundll32.exe	27
PID 1696 wrote to memory of 944	1696	rundll32.exe	27
PID 1696 wrote to memory of 944	1696	rundll32.exe	27
PID 1696 wrote to memory of 944	1696	rundll32.exe	27
PID 1696 wrote to memory of 944	1696	rundll32.exe	27
PID 1696 wrote to memory of 944	1696	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#1
  2⤵
  PID:944

memory/944-55-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download