f01cac924f32efd1bc046f95a8b7f68c9caed70f3ef718b29b07bd213bf35958

Analysis

max time kernel
112s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 05:08

Target

f01cac924f32efd1bc046f95a8b7f68c9caed70f3ef718b29b07bd213bf35958.dll
Size

24KB
MD5

f1e2d1cdf1d0645cf7756a7194578d54
SHA1

86b94931b1aff2453053204ae21585466e4d9e3c
SHA256

f01cac924f32efd1bc046f95a8b7f68c9caed70f3ef718b29b07bd213bf35958
SHA512

f12f7c9e8c56a45eaa5dc0b8318e5da19829d9c28a84ef0349eab4057ad24ce09e47fd7e510d09f9e6d5c50123e66164dd46f3dc564bb3b00495caf9d87d2850
SSDEEP

384:rh4VO4JDNeGLlx2O/lICZc2u0qyBYQFYSxiT3v2E5g/9Qjf:tQ1uO/lIutSQ28iT3OE5iqjf

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1400 wrote to memory of 4984	1400	rundll32.exe	81
PID 1400 wrote to memory of 4984	1400	rundll32.exe	81
PID 1400 wrote to memory of 4984	1400	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f01cac924f32efd1bc046f95a8b7f68c9caed70f3ef718b29b07bd213bf35958.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f01cac924f32efd1bc046f95a8b7f68c9caed70f3ef718b29b07bd213bf35958.dll,#1
  2⤵
  PID:4984

memory/4984-133-0x0000000075B10000-0x0000000075B17000-memory.dmp

Filesize
28KB

Download
memory/4984-134-0x0000000075B10000-0x0000000075B17000-memory.dmp

Filesize
28KB

Download