bd59b020db3068e59f3350f1b7c090755dad60f4ff5abc086346f94f4a788f76

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02-03-2024 19:54

Target

1964-54-0x0000000010000000-0x0000000010023000-memory.dll
Size

140KB
MD5

d398f3b545e225cfc8efc9da7fd1bca2
SHA1

8aa3ad287d690c8bef11d44397c44ec7566b5e50
SHA256

bd59b020db3068e59f3350f1b7c090755dad60f4ff5abc086346f94f4a788f76
SHA512

034e7c3958f691160fb5c859ce585284b2f48ecf65652883ad54b06ad8218f56dc4fa78a2b9b3b2322c8cec763b07890ffcbb68d9211aa06d1b099ad7b7c2e35
SSDEEP

3072:UjPR4nxKRttVbYKAk67CERzMRAPJyDnYMTBfPuq:UHRxbYK0CEMaPJynYMTBHN

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2100 wrote to memory of 356	2100	rundll32.exe	rundll32.exe
PID 2100 wrote to memory of 356	2100	rundll32.exe	rundll32.exe
PID 2100 wrote to memory of 356	2100	rundll32.exe	rundll32.exe
PID 2100 wrote to memory of 356	2100	rundll32.exe	rundll32.exe
PID 2100 wrote to memory of 356	2100	rundll32.exe	rundll32.exe
PID 2100 wrote to memory of 356	2100	rundll32.exe	rundll32.exe
PID 2100 wrote to memory of 356	2100	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1964-54-0x0000000010000000-0x0000000010023000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2100

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1964-54-0x0000000010000000-0x0000000010023000-memory.dll,#1
2⤵
PID:356