7788ae17bd36f8986e740e18863b3d03a60f377ae635d76f93ec0201cdaa207d

Analysis

max time kernel
146s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06-03-2024 17:34

Target

1376-56-0x00000000002E0000-0x0000000000304000-memory.dll
Size

144KB
MD5

7e77805b1704f9bfcc11145540004d2f
SHA1

e7c6cfd13a97285d53c22235138cc3332e46780c
SHA256

7788ae17bd36f8986e740e18863b3d03a60f377ae635d76f93ec0201cdaa207d
SHA512

a322d4c24a5b17a3a2b9a9e51908d82be263a989eb30324f89b7659277dbe8f5be0c43cd293acb47d25274db828261dd13b2827e224d4e9bb8c0544ba3569083
SSDEEP

3072:q5EwMls1sTQAEaz3TVNrcjiOApJOh3yoTBfv2N/Tg:8MKsvEafzrWi7pJQ3yoTBn2N0

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	Process	procid_target
PID 1028 wrote to memory of 4296	1028	rundll32.exe	88
PID 1028 wrote to memory of 4296	1028	rundll32.exe	88
PID 1028 wrote to memory of 4296	1028	rundll32.exe	88
PID 4296 wrote to memory of 4444	4296	rundll32.exe	89
PID 4296 wrote to memory of 4444	4296	rundll32.exe	89
PID 4296 wrote to memory of 4444	4296	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-56-0x00000000002E0000-0x0000000000304000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-56-0x00000000002E0000-0x0000000000304000-memory.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4296
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-56-0x00000000002E0000-0x0000000000304000-memory.dll,#1
    3⤵
    PID:4444