921d022f41c5d1e98ab24c901ed51ca409400834b5d678fb08561687b5be2e0a

Analysis

max time kernel
28s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
16/06/2023, 12:57

Target

2040-55-0x0000000000200000-0x0000000000224000-memory.dll
Size

144KB
MD5

1f83c09617d03f53ce67f92e5dd561d6
SHA1

7f67fac9e4b3e95fbeb9b2a7f7da838bf14acb6a
SHA256

921d022f41c5d1e98ab24c901ed51ca409400834b5d678fb08561687b5be2e0a
SHA512

05bc90fd770b4a7fb7c4c8e0b0cf6e7c6ef60325d5719f3eb166fdb7795f9d0d3d101ad410cd7df727535e0dc2fe830505a025fa545cc874856ccb39e6ebec96
SSDEEP

3072:1hwW5VE0wkrovXSWNyhwAsohKJJG/F8TBfwsGEdpn:NwkKSW4hFPhKJA/F8TBIsFdpn

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 1948	1748	rundll32.exe	28
PID 1748 wrote to memory of 1948	1748	rundll32.exe	28
PID 1748 wrote to memory of 1948	1748	rundll32.exe	28
PID 1748 wrote to memory of 1948	1748	rundll32.exe	28
PID 1748 wrote to memory of 1948	1748	rundll32.exe	28
PID 1748 wrote to memory of 1948	1748	rundll32.exe	28
PID 1748 wrote to memory of 1948	1748	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2040-55-0x0000000000200000-0x0000000000224000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2040-55-0x0000000000200000-0x0000000000224000-memory.dll,#1
  2⤵
  PID:1948