51c267e5aa1553c403bbbc49660b0ca520a6d36350f9e0a35fddd01458bc7a65

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
02-03-2023 21:21

Target

4436-133-0x0000000000D30000-0x0000000000D53000-memory.dll
Size

140KB
MD5

7d33b2c822d26d16c6e02062154a81c3
SHA1

59139555f33df7e4c321e051e11f9a2899c28258
SHA256

51c267e5aa1553c403bbbc49660b0ca520a6d36350f9e0a35fddd01458bc7a65
SHA512

36b5b04d87af54d69401904ceb777bc41158246ea7cc8c2cff7420a0db1b6dd1a092a7b05335224893741b1d402fcae8ddd4283831c0d60a8f1c593abe37511f
SSDEEP

3072:vMucC9DExaqOALMv/uHWlA3J+ml6MTBfPgM/tL:0w6aq5Mv/DW3JPl6MTBHgM/B

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 1708	2012	rundll32.exe	28
PID 2012 wrote to memory of 1708	2012	rundll32.exe	28
PID 2012 wrote to memory of 1708	2012	rundll32.exe	28
PID 2012 wrote to memory of 1708	2012	rundll32.exe	28
PID 2012 wrote to memory of 1708	2012	rundll32.exe	28
PID 2012 wrote to memory of 1708	2012	rundll32.exe	28
PID 2012 wrote to memory of 1708	2012	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4436-133-0x0000000000D30000-0x0000000000D53000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4436-133-0x0000000000D30000-0x0000000000D53000-memory.dll,#1
  2⤵
  PID:1708