8813d68eda34235a89118e3ca82c867b8351294f1b13db31462a4d52ddd965e5

Analysis

max time kernel
28s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
10/05/2023, 18:53

Target

1704-55-0x0000000010000000-0x0000000010024000-memory.dll
Size

144KB
MD5

b6f1f4a546280fa3af06e0ece595b51c
SHA1

0f1c01eee3cdec7f9513b75d4db3934ce77d0a86
SHA256

8813d68eda34235a89118e3ca82c867b8351294f1b13db31462a4d52ddd965e5
SHA512

1959b91b7b436b6b33c27bd92ff9e15594a176efe53ecdb8306a4b71d873829a78cc04e209d13ab9ab1287481e33edcebefec1b06cdf24a6dc6b74913640f14d
SSDEEP

3072:AHgHsJq6uUu9VrVHl8j+YAHJYTVBHS8TBffMN6g:1kwUun5lC+9HJwVBHS8TB3MNz

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 832	1388	rundll32.exe	28
PID 1388 wrote to memory of 832	1388	rundll32.exe	28
PID 1388 wrote to memory of 832	1388	rundll32.exe	28
PID 1388 wrote to memory of 832	1388	rundll32.exe	28
PID 1388 wrote to memory of 832	1388	rundll32.exe	28
PID 1388 wrote to memory of 832	1388	rundll32.exe	28
PID 1388 wrote to memory of 832	1388	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-55-0x0000000010000000-0x0000000010024000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-55-0x0000000010000000-0x0000000010024000-memory.dll,#1
  2⤵
  PID:832