ccacb51ec00e6a383e2eb320df02fade6b902d26bdc1772ef5a799ac7be3cec7

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03-01-2023 15:39

Target

1716-57-0x00000000001B0000-0x00000000001D2000-memory.dll
Size

136KB
MD5

bf469d43267320e2e1e05f6c22667423
SHA1

3c8411a20f9ef7b0fc4855ff801df224e9204880
SHA256

ccacb51ec00e6a383e2eb320df02fade6b902d26bdc1772ef5a799ac7be3cec7
SHA512

6508c194ffdfee7999fb0056959d89e884d55284b06563885b1f559a5000840db20d10be1434616513b66592660f953d45a0839d36d2ad4fc3baaa4abd6f367f
SSDEEP

3072:yEtcceW973aTDc+7A/AGJDnds5TBfVRe9e:yUccebTDcRIGJDds5TBtw9

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1464 wrote to memory of 1380	1464	rundll32.exe	rundll32.exe
PID 1464 wrote to memory of 1380	1464	rundll32.exe	rundll32.exe
PID 1464 wrote to memory of 1380	1464	rundll32.exe	rundll32.exe
PID 1464 wrote to memory of 1380	1464	rundll32.exe	rundll32.exe
PID 1464 wrote to memory of 1380	1464	rundll32.exe	rundll32.exe
PID 1464 wrote to memory of 1380	1464	rundll32.exe	rundll32.exe
PID 1464 wrote to memory of 1380	1464	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1716-57-0x00000000001B0000-0x00000000001D2000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1464

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1716-57-0x00000000001B0000-0x00000000001D2000-memory.dll,#1
2⤵
PID:1380

memory/1380-54-0x0000000000000000-mapping.dmp

Download
memory/1380-55-0x0000000076581000-0x0000000076583000-memory.dmp

Filesize
8KB

Download