da96ab9066c82c4c0350c25d4dc0486472c9ab620dc353768ed31846bef60dd7

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 11:17

Target

$SYSDIR/MMUTIL32.dll
Size

61KB
MD5

669874d162286ccaa8a003cc1dee5b99
SHA1

c3d0f9f0d778a824b8cd7e81c46733d7a2f4d7bc
SHA256

41974aedfd7b9ec8be6f734e84aa327d55a2aba02cf31d89edd4440bc933c44c
SHA512

4f4d4a58f65309d0cdd82749d4081cccec194581a28b1da6b80e03e20da4360b45abaceba93c151529b837b339ba029b803cbf617b0d364c2b09133a4d120b0d
SSDEEP

768:ijL4LqkIZg1+3lOwvA+0XYzd88Z+sNV5nFCHW3mGToHut9PjvnhuLKEDRzmkMUnp:i4LqHzV0X18jNV7TcHu3QdPMUVMo

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 2992	2848	rundll32.exe	28
PID 2848 wrote to memory of 2992	2848	rundll32.exe	28
PID 2848 wrote to memory of 2992	2848	rundll32.exe	28
PID 2848 wrote to memory of 2992	2848	rundll32.exe	28
PID 2848 wrote to memory of 2992	2848	rundll32.exe	28
PID 2848 wrote to memory of 2992	2848	rundll32.exe	28
PID 2848 wrote to memory of 2992	2848	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\MMUTIL32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\MMUTIL32.dll,#1
  2⤵
  PID:2992

memory/2992-0-0x0000000000170000-0x0000000000184000-memory.dmp

Filesize
80KB

Download