dc8f61a3c9960b4da2bcbb0840f3cfcd1b4398d018403373edb420b158df5193

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06-06-2024 14:18

Target

1948-3-0x0000000000240000-0x0000000000248000-memory.dll
Size

32KB
MD5

4299e12b1981178d6d6e61b4b76a110c
SHA1

108f0fcb57260771b399ae045fcc98a82c8d67df
SHA256

dc8f61a3c9960b4da2bcbb0840f3cfcd1b4398d018403373edb420b158df5193
SHA512

35e5374dea4b366181715b8f6df3a3e2f041ec82830587dd08e7a79963607932036c2a2885a5c18afee6a183738908d5fcfbb3420d7517135753861b6ab9bea8
SSDEEP

384:XajSEIxxP5OZAlAPosPkUfvKMp5yEZ0SjYq:Xajod5O+YkUXNrjP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2608 wrote to memory of 2480	2608	rundll32.exe	28
PID 2608 wrote to memory of 2480	2608	rundll32.exe	28
PID 2608 wrote to memory of 2480	2608	rundll32.exe	28
PID 2608 wrote to memory of 2480	2608	rundll32.exe	28
PID 2608 wrote to memory of 2480	2608	rundll32.exe	28
PID 2608 wrote to memory of 2480	2608	rundll32.exe	28
PID 2608 wrote to memory of 2480	2608	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1948-3-0x0000000000240000-0x0000000000248000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1948-3-0x0000000000240000-0x0000000000248000-memory.dll,#1
  2⤵
  PID:2480