32a941abca850eade46198cee2f12475c05a0a712a61f11b91da289bf1decd26

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/01/2023, 01:35

Target

1912-57-0x0000000000190000-0x00000000001B2000-memory.dll
Size

136KB
MD5

959f79799ed2b8bbf6f0c909d7006991
SHA1

f67f4b51b2b861770b2a318113d1648417c162c9
SHA256

32a941abca850eade46198cee2f12475c05a0a712a61f11b91da289bf1decd26
SHA512

7fef5cca60de66b396c7d920733bfa1497c90f16cbc505da24acfda10c5de47e5a8bdf417db0f3bc5e4673110291e2e86712b6781be8894c0118acdbcb580ef6
SSDEEP

3072:jHQgaOi+EfiOBcnFAshJt5lwdTBfZbel4:rQddfiln2+JvlwdTBxKl

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1408 wrote to memory of 1456	1408	rundll32.exe	27
PID 1408 wrote to memory of 1456	1408	rundll32.exe	27
PID 1408 wrote to memory of 1456	1408	rundll32.exe	27
PID 1408 wrote to memory of 1456	1408	rundll32.exe	27
PID 1408 wrote to memory of 1456	1408	rundll32.exe	27
PID 1408 wrote to memory of 1456	1408	rundll32.exe	27
PID 1408 wrote to memory of 1456	1408	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1912-57-0x0000000000190000-0x00000000001B2000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1408
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1912-57-0x0000000000190000-0x00000000001B2000-memory.dll,#1
  2⤵
  PID:1456

memory/1456-55-0x0000000074B51000-0x0000000074B53000-memory.dmp

Filesize
8KB

Download