4345341f6c062c955f5d7dc811135bbe5a26685c773d521f081a19218e86aceb

Analysis

max time kernel
45s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/02/2023, 09:01

Target

1796-57-0x0000000000720000-0x0000000000743000-memory.dll
Size

140KB
MD5

0cd1c6716009533bed2d47ae0ae51d45
SHA1

8a4d7ac33738ffcd4e3d34d75a28aa32afd6f17d
SHA256

4345341f6c062c955f5d7dc811135bbe5a26685c773d521f081a19218e86aceb
SHA512

a3e0107b2e304c221174c2758b3ed99cebbff2c1fffee000f795501386cc064330a03e3ff890c62bc643fe6b8d32231cee65ea9627fedce780f2f34e9ecc41cc
SSDEEP

3072:38CrZ6LBimQTHPQ4ZRsQyAjJjARvMDTBf/1gA:j6LBimYvQZQXjJMRvMDTBX1g

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 1056	1808	rundll32.exe	27
PID 1808 wrote to memory of 1056	1808	rundll32.exe	27
PID 1808 wrote to memory of 1056	1808	rundll32.exe	27
PID 1808 wrote to memory of 1056	1808	rundll32.exe	27
PID 1808 wrote to memory of 1056	1808	rundll32.exe	27
PID 1808 wrote to memory of 1056	1808	rundll32.exe	27
PID 1808 wrote to memory of 1056	1808	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x0000000000720000-0x0000000000743000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x0000000000720000-0x0000000000743000-memory.dll,#1
  2⤵
  PID:1056

memory/1056-55-0x0000000075AC1000-0x0000000075AC3000-memory.dmp

Filesize
8KB

Download