93646a5c48ea03eff9767ec6fcacea0799f449296d031524832adff217ad284d

Resubmissions

02-03-2024 10:38

02-03-2024 06:52

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02-03-2024 06:52

Target

3460-134-0x0000000010000000-0x0000000010023000-memory.dll
Size

140KB
MD5

bbb6c0031fd09c75e9c8e6921ee69142
SHA1

42d77b2fc9938b9b9ecc0e7ad0aacf4508caff39
SHA256

93646a5c48ea03eff9767ec6fcacea0799f449296d031524832adff217ad284d
SHA512

bd1ea2f965c18f2b840318b985c86b63b7c46f782f8e3c7c6758b3bf85d7e0bcff9dafe06da37564c7ae990a79145b4d5552cfbfa8f7fc093580f30f0c2d9f1b
SSDEEP

3072:YKUR+AIznCp7BQCrZJzSWjsdA0Jl0ns9p8TBfPVo/lo:YbIznCVKCtcWjs+0J6nK8TBHVo/S

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 2512 wrote to memory of 2736	2512	rundll32.exe	28
PID 2512 wrote to memory of 2736	2512	rundll32.exe	28
PID 2512 wrote to memory of 2736	2512	rundll32.exe	28
PID 2512 wrote to memory of 2736	2512	rundll32.exe	28
PID 2512 wrote to memory of 2736	2512	rundll32.exe	28
PID 2512 wrote to memory of 2736	2512	rundll32.exe	28
PID 2512 wrote to memory of 2736	2512	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3460-134-0x0000000010000000-0x0000000010023000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3460-134-0x0000000010000000-0x0000000010023000-memory.dll,#1
  2⤵
  PID:2736