e595f9ff038332868902bcce95aa44b134c07a3ab6cb500ff4dfac4f00d4abf8

Analysis

max time kernel
27s
max time network
31s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
07/06/2023, 13:53

Target

1336-61-0x0000000010000000-0x0000000010079000-memory.dll
Size

484KB
MD5

b6b738628fde4e48e3c0576342e79fd2
SHA1

f893b640c2e53741ead5a59681dc2cdf71f1be80
SHA256

e595f9ff038332868902bcce95aa44b134c07a3ab6cb500ff4dfac4f00d4abf8
SHA512

8a9a3cc9ee9e76778a51d5f10559ff97b63f9e9284c76ef3de367be819d2c6b55ade430ee0be8ede75cb1c88a390cd94aaaf83788c76d2e760707cbcd0b92448
SSDEEP

12288:tF284tTmhZaNcktl+YB/6Yas7ebgP26URczEp/:tF2DtTyZC+YB/PaBbg+6a

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 1636	1724	rundll32.exe	27
PID 1724 wrote to memory of 1636	1724	rundll32.exe	27
PID 1724 wrote to memory of 1636	1724	rundll32.exe	27
PID 1724 wrote to memory of 1636	1724	rundll32.exe	27
PID 1724 wrote to memory of 1636	1724	rundll32.exe	27
PID 1724 wrote to memory of 1636	1724	rundll32.exe	27
PID 1724 wrote to memory of 1636	1724	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1336-61-0x0000000010000000-0x0000000010079000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1336-61-0x0000000010000000-0x0000000010079000-memory.dll,#1
  2⤵
  PID:1636