da68ff966733742e5fbb2dd84ee7a296f61af8a2c3ecd153e20a48ddea2ecd6c

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11-03-2024 21:35

Target

1028-56-0x0000000010000000-0x0000000010024000-memory.dll
Size

144KB
MD5

955c4ac88d9c97e70bd089d16df3a556
SHA1

bdca898e23ea0a721f0e0604adaf365b5419ef23
SHA256

da68ff966733742e5fbb2dd84ee7a296f61af8a2c3ecd153e20a48ddea2ecd6c
SHA512

abe2ab52739f5ea733f32461e72665f54becaea6f2aea53f3c6e674c2ae61053e3563ec27da679d88163fe3a847eab3b0d9dd83122e366be78733248a3d0807a
SSDEEP

3072:hFQGpV0kS95ObbMv8mCOihAAfBqJZmtfmOcTBfw8mEE:VS9kPyCVh1fBqJEtfmOcTBI8lE

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1864 wrote to memory of 2476	1864	rundll32.exe	rundll32.exe
PID 1864 wrote to memory of 2476	1864	rundll32.exe	rundll32.exe
PID 1864 wrote to memory of 2476	1864	rundll32.exe	rundll32.exe
PID 1864 wrote to memory of 2476	1864	rundll32.exe	rundll32.exe
PID 1864 wrote to memory of 2476	1864	rundll32.exe	rundll32.exe
PID 1864 wrote to memory of 2476	1864	rundll32.exe	rundll32.exe
PID 1864 wrote to memory of 2476	1864	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1028-56-0x0000000010000000-0x0000000010024000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1864

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1028-56-0x0000000010000000-0x0000000010024000-memory.dll,#1
2⤵
PID:2476