73f0096da8b48124cee2ef29db7312057bb302997d8984e2fc640b5bc548c15f

Analysis

max time kernel
15s
max time network
3s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 09:36 UTC

Target

73f0096da8b48124cee2ef29db7312057bb302997d8984e2fc640b5bc548c15f.dll
Size

38KB
MD5

aed9e846f4d7facc20cfcb9af7c462fd
SHA1

c529fb58785f86eda67cd8c2fbf98bfc09f082b5
SHA256

73f0096da8b48124cee2ef29db7312057bb302997d8984e2fc640b5bc548c15f
SHA512

1b8ac2a2c8f45054296cbf988f78399960ff455931e4b31a92953b15d426d4d43f354955e6d6d6f43d656960c036c8aa85711e7505a6dff2c5e157536d7cbd16
SSDEEP

768:j/mVuAeZcBam7spi9y3zBVtTG+1QnxoYQBC8:jeheGam7s3D3CxbQBC8

Score

1^/10

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1544 wrote to memory of 2304	1544	rundll32.exe	75
PID 1544 wrote to memory of 2304	1544	rundll32.exe	75
PID 1544 wrote to memory of 2304	1544	rundll32.exe	75
PID 2304 wrote to memory of 4756	2304	rundll32.exe	76
PID 2304 wrote to memory of 4756	2304	rundll32.exe	76
PID 2304 wrote to memory of 4756	2304	rundll32.exe	76
PID 4756 wrote to memory of 4544	4756	net.exe	78
PID 4756 wrote to memory of 4544	4756	net.exe	78
PID 4756 wrote to memory of 4544	4756	net.exe	78
PID 2304 wrote to memory of 4424	2304	rundll32.exe	79
PID 2304 wrote to memory of 4424	2304	rundll32.exe	79
PID 2304 wrote to memory of 4424	2304	rundll32.exe	79
PID 4424 wrote to memory of 3976	4424	net.exe	81
PID 4424 wrote to memory of 3976	4424	net.exe	81
PID 4424 wrote to memory of 3976	4424	net.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\73f0096da8b48124cee2ef29db7312057bb302997d8984e2fc640b5bc548c15f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\73f0096da8b48124cee2ef29db7312057bb302997d8984e2fc640b5bc548c15f.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2304
- - C:\Windows\SysWOW64\net.exe
    net stop winss
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4756
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop winss
      4⤵
      PID:4544
- - C:\Windows\SysWOW64\net.exe
    net stop OcHealthMon
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4424
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop OcHealthMon
      4⤵
      PID:3976

memory/2304-133-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/2304-134-0x00000000005D0000-0x00000000005D5000-memory.dmp

Filesize
20KB

Download