d436fea496c2c26b861f2b581b6f230a44f6e6d0afa2b09a75a803785ba68748

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05-03-2024 04:10

Target

2008-54-0x0000000000170000-0x0000000000194000-memory.dll
Size

144KB
MD5

67d313a543e5e6f0108c724b84d5732e
SHA1

f5bc15a3fc36a5bb814c1e99b7df1b61ba74f46e
SHA256

d436fea496c2c26b861f2b581b6f230a44f6e6d0afa2b09a75a803785ba68748
SHA512

c8e7794850c6fee32c7eda19b84848226a5e87cd3a541c0dbba9116da231bb558eb86b5d658620612c09c14d3c41ca518bbe898e7f9a6f99bd178522b2b8226b
SSDEEP

3072:JHWOa07CDy/7qsE9nGA1JUTFr4TBf//Wpn2d:4O/msEpj1JQFr4TB3

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 2660 wrote to memory of 2832	2660	rundll32.exe	28
PID 2660 wrote to memory of 2832	2660	rundll32.exe	28
PID 2660 wrote to memory of 2832	2660	rundll32.exe	28
PID 2660 wrote to memory of 2832	2660	rundll32.exe	28
PID 2660 wrote to memory of 2832	2660	rundll32.exe	28
PID 2660 wrote to memory of 2832	2660	rundll32.exe	28
PID 2660 wrote to memory of 2832	2660	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2008-54-0x0000000000170000-0x0000000000194000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2008-54-0x0000000000170000-0x0000000000194000-memory.dll,#1
  2⤵
  PID:2832