0a9481a414ad1d925c6451b1fbd71e392913d29bf67c76c738385c6f070c3e69

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02-03-2024 14:27

Target

1132-55-0x00000000007C0000-0x00000000007E3000-memory.dll
Size

140KB
MD5

59dcd50342667987f8a4db807c7a6332
SHA1

4b64ac95baa609dbf217f4fe4e70c315fdafb1dd
SHA256

0a9481a414ad1d925c6451b1fbd71e392913d29bf67c76c738385c6f070c3e69
SHA512

274fb038ade388983835a8517ec0eb53c04774c1fd86b48693cadfadb29bc8b11951d5a0cd00aba5b5c7db078c0d4edb64f697c94b8b9cdcc3d9391bbc82210e
SSDEEP

3072:w/RvTz06+hBObWcRJOAmJ3L/jYTBffLnEnsFm:C+hGWc7mJb/jYTB3LGsF

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2860 wrote to memory of 2940	2860	rundll32.exe	rundll32.exe
PID 2860 wrote to memory of 2940	2860	rundll32.exe	rundll32.exe
PID 2860 wrote to memory of 2940	2860	rundll32.exe	rundll32.exe
PID 2860 wrote to memory of 2940	2860	rundll32.exe	rundll32.exe
PID 2860 wrote to memory of 2940	2860	rundll32.exe	rundll32.exe
PID 2860 wrote to memory of 2940	2860	rundll32.exe	rundll32.exe
PID 2860 wrote to memory of 2940	2860	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1132-55-0x00000000007C0000-0x00000000007E3000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2860

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1132-55-0x00000000007C0000-0x00000000007E3000-memory.dll,#1
2⤵
PID:2940