60b8d9b4c87ab32ada3da59608aa0ad722bae4d351acdbeaf90b61729863ee25

Analysis

max time kernel
27s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
14-03-2023 17:20

Target

2044-57-0x0000000004130000-0x0000000004153000-memory.dll
Size

140KB
MD5

971c0cc66f6fc343d3591b94ba5089ca
SHA1

26b2ffeea143139520110274fde7b4754d9a5a6e
SHA256

60b8d9b4c87ab32ada3da59608aa0ad722bae4d351acdbeaf90b61729863ee25
SHA512

cc04e30b30c303daa2e1f5876d8a85b47b8cd63d4a5fa70c54523dd594db771ded6c4793a6afc59052369c78956f007ef398b76fd7cc194e9d1d82de7ba33c1d
SSDEEP

3072:uVHCiSexeeIbkaitjnt/5CAEJ5UVHMTBffk1/BIMv+n:uJxAkaCjn/HEJqVHMTB3kFBRv

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1976 wrote to memory of 1700	1976	rundll32.exe	rundll32.exe
PID 1976 wrote to memory of 1700	1976	rundll32.exe	rundll32.exe
PID 1976 wrote to memory of 1700	1976	rundll32.exe	rundll32.exe
PID 1976 wrote to memory of 1700	1976	rundll32.exe	rundll32.exe
PID 1976 wrote to memory of 1700	1976	rundll32.exe	rundll32.exe
PID 1976 wrote to memory of 1700	1976	rundll32.exe	rundll32.exe
PID 1976 wrote to memory of 1700	1976	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1976

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1
2⤵
PID:1700