5f6979b66b0450b8183aa0497d2468ba5f7a4a3d88b56891fc97d3dfce2f6a86

Analysis

max time kernel
28s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
31/12/2022, 23:43

Target

1228-57-0x0000000000190000-0x00000000001B2000-memory.dll
Size

136KB
MD5

8bbeae51cd6464b556e4240b9d707ee5
SHA1

6ab30e533fe9e51b38b05ac2879a47d2dd50f1e6
SHA256

5f6979b66b0450b8183aa0497d2468ba5f7a4a3d88b56891fc97d3dfce2f6a86
SHA512

a6fd2481aaa2f27d8f44c775f324ebe9fb8cac1203277498e63fe0735ae1bcbefd40c03e1d21f1999c550d3ce2c37262a5ad9febadf3f321b6bec4013c182b39
SSDEEP

3072:jHQgaOi+EfiOBcnFAshJt5lVdTBfZbel6:rQddfiln2+JvlVdTBxKl

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 940	1364	rundll32.exe	28
PID 1364 wrote to memory of 940	1364	rundll32.exe	28
PID 1364 wrote to memory of 940	1364	rundll32.exe	28
PID 1364 wrote to memory of 940	1364	rundll32.exe	28
PID 1364 wrote to memory of 940	1364	rundll32.exe	28
PID 1364 wrote to memory of 940	1364	rundll32.exe	28
PID 1364 wrote to memory of 940	1364	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1228-57-0x0000000000190000-0x00000000001B2000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1228-57-0x0000000000190000-0x00000000001B2000-memory.dll,#1
  2⤵
  PID:940

memory/940-55-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download