5996e2318c7331fe411132d7bac4f9bb1681a046b26ee0ccd9f2e2967247442e

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
19-01-2023 19:04

Target

1752-57-0x00000000003F0000-0x0000000000413000-memory.dll
Size

140KB
MD5

b4760b271cb403bd5950c338295bcbef
SHA1

863723837018a2aade922b5e16c33c51ef3e0f8a
SHA256

5996e2318c7331fe411132d7bac4f9bb1681a046b26ee0ccd9f2e2967247442e
SHA512

10168b192579dd01acd0af6a97fd0dd482d89668f4ce9bc3daef506cc18e1935b06dabd7f4f18b8db3606919013b8910e5ec15b01a1ee7ffbc840867cef7f768
SSDEEP

3072:jBkvXFCiQPNG7KlEdYPU65t60/aJ6gB/+po0j:jBkfF9y4KlEKPBt60CJ6+Gpo0j

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1752 wrote to memory of 1728	1752	rundll32.exe	rundll32.exe
PID 1752 wrote to memory of 1728	1752	rundll32.exe	rundll32.exe
PID 1752 wrote to memory of 1728	1752	rundll32.exe	rundll32.exe
PID 1752 wrote to memory of 1728	1752	rundll32.exe	rundll32.exe
PID 1752 wrote to memory of 1728	1752	rundll32.exe	rundll32.exe
PID 1752 wrote to memory of 1728	1752	rundll32.exe	rundll32.exe
PID 1752 wrote to memory of 1728	1752	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1752-57-0x00000000003F0000-0x0000000000413000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1752-57-0x00000000003F0000-0x0000000000413000-memory.dll,#1
  2⤵
  PID:1728

memory/1728-54-0x0000000000000000-mapping.dmp

Download
memory/1728-55-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download