5bacfd5c60a1ca6b4cbc52e227cc66ed8499b82cc769e34407ac87eb3bc5f1ac

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
18-10-2023 08:59

Target

2096-0-0x0000000000480000-0x00000000004A2000-memory.dll
Size

136KB
MD5

eac511d102109de27cc9210e2b521e34
SHA1

da9c20448524521f8c14610736631f1a10fee56e
SHA256

5bacfd5c60a1ca6b4cbc52e227cc66ed8499b82cc769e34407ac87eb3bc5f1ac
SHA512

67507d722d35f8e375c2d4b2d9e39057aa5062feffc9ae21170f6a096814d0536095928a5e87af28118eaa6aa26dc281663de570956481520c74e20185fbf6b6
SSDEEP

1536:1uY3Pzq35TR4CGbPTDy80pgn5qZW3Jsz/P9zd004egllXVix/IIiRaMPtlVI3uvF:1t3PuUrPDy80GElR4v0x+j6+vcT5vD

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1292 wrote to memory of 1140	1292	rundll32.exe	rundll32.exe
PID 1292 wrote to memory of 1140	1292	rundll32.exe	rundll32.exe
PID 1292 wrote to memory of 1140	1292	rundll32.exe	rundll32.exe
PID 1292 wrote to memory of 1140	1292	rundll32.exe	rundll32.exe
PID 1292 wrote to memory of 1140	1292	rundll32.exe	rundll32.exe
PID 1292 wrote to memory of 1140	1292	rundll32.exe	rundll32.exe
PID 1292 wrote to memory of 1140	1292	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2096-0-0x0000000000480000-0x00000000004A2000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1292

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2096-0-0x0000000000480000-0x00000000004A2000-memory.dll,#1
2⤵
PID:1140