c65356d5b75f2ef39b1aa1104a51ede11e285f4b66e392fe07aa4bbd8266321f

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12-03-2024 14:06

Target

1036-55-0x0000000010000000-0x0000000010024000-memory.dll
Size

144KB
MD5

ebb4f4cd3d168685203580d9054e4fdf
SHA1

60247c8a39f4760ec858c4fed7d1af0cabcc0f85
SHA256

c65356d5b75f2ef39b1aa1104a51ede11e285f4b66e392fe07aa4bbd8266321f
SHA512

530c8ef12e80a04bb193c5ed48a4048156924b2f27a04ee8b5017119568c97a2d9d7d49452734fcd6a67f701394864348164fbf70ae8d3ac8b2e28e9d727a46a
SSDEEP

3072:VnPYcZtZHhf+pE90L6+j5zZCb+dJAC8nJxmefH8cTBfwFy1bWeMhM:5Vh2pE90L6mzZCSdCdnJsefccTBIFwCK

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 2212 wrote to memory of 2216	2212	rundll32.exe	28
PID 2212 wrote to memory of 2216	2212	rundll32.exe	28
PID 2212 wrote to memory of 2216	2212	rundll32.exe	28
PID 2212 wrote to memory of 2216	2212	rundll32.exe	28
PID 2212 wrote to memory of 2216	2212	rundll32.exe	28
PID 2212 wrote to memory of 2216	2212	rundll32.exe	28
PID 2212 wrote to memory of 2216	2212	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1036-55-0x0000000010000000-0x0000000010024000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1036-55-0x0000000010000000-0x0000000010024000-memory.dll,#1
  2⤵
  PID:2216