7788ae17bd36f8986e740e18863b3d03a60f377ae635d76f93ec0201cdaa207d

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06-03-2024 17:34

Target

1376-56-0x00000000002E0000-0x0000000000304000-memory.dll
Size

144KB
MD5

7e77805b1704f9bfcc11145540004d2f
SHA1

e7c6cfd13a97285d53c22235138cc3332e46780c
SHA256

7788ae17bd36f8986e740e18863b3d03a60f377ae635d76f93ec0201cdaa207d
SHA512

a322d4c24a5b17a3a2b9a9e51908d82be263a989eb30324f89b7659277dbe8f5be0c43cd293acb47d25274db828261dd13b2827e224d4e9bb8c0544ba3569083
SSDEEP

3072:q5EwMls1sTQAEaz3TVNrcjiOApJOh3yoTBfv2N/Tg:8MKsvEafzrWi7pJQ3yoTBn2N0

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 3020 wrote to memory of 2040	3020	rundll32.exe	28
PID 3020 wrote to memory of 2040	3020	rundll32.exe	28
PID 3020 wrote to memory of 2040	3020	rundll32.exe	28
PID 3020 wrote to memory of 2040	3020	rundll32.exe	28
PID 3020 wrote to memory of 2040	3020	rundll32.exe	28
PID 3020 wrote to memory of 2040	3020	rundll32.exe	28
PID 3020 wrote to memory of 2040	3020	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-56-0x00000000002E0000-0x0000000000304000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-56-0x00000000002E0000-0x0000000000304000-memory.dll,#1
  2⤵
  PID:2040