93646a5c48ea03eff9767ec6fcacea0799f449296d031524832adff217ad284d

Resubmissions

02/03/2024, 10:38

02/03/2024, 06:52

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02/03/2024, 06:52

Target
3460-134-0x0000000010000000-0x0000000010023000-memory.dll
Size 140KB
Sample240302-hm9jxabc91
SHA256 93646a5c48ea03eff9767ec6fcacea0799f449296d031524832adff217ad284d
MD5 bbb6c0031fd09c75e9c8e6921ee69142
SHA1 42d77b2fc9938b9b9ecc0e7ad0aacf4508caff39
SHA512 bd1ea2f965c18f2b840318b985c86b63b7c46f782f8e3c7c6758b3bf85d7e0bcff9dafe06da37564c7ae990a79145b4d5552cfbfa8f7fc093580f30f0c2d9f1b
SSDEEP 3072:YKUR+AIznCp7BQCrZJzSWjsdA0Jl0ns9p8TBfPVo/lo:YbIznCVKCtcWjs+0J6nK8TBHVo/S
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 2736	2512	rundll32.exe	28
PID 2512 wrote to memory of 2736	2512	rundll32.exe	28
PID 2512 wrote to memory of 2736	2512	rundll32.exe	28
PID 2512 wrote to memory of 2736	2512	rundll32.exe	28
PID 2512 wrote to memory of 2736	2512	rundll32.exe	28
PID 2512 wrote to memory of 2736	2512	rundll32.exe	28
PID 2512 wrote to memory of 2736	2512	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3460-134-0x0000000010000000-0x0000000010023000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3460-134-0x0000000010000000-0x0000000010023000-memory.dll,#1
  2⤵
  PID:2736