4a25c958928aa7f68ed18f962ff48b0a726e0eb60dde38f208565b395ceec235

Analysis

max time kernel
132s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 14:08

Target

4a25c958928aa7f68ed18f962ff48b0a726e0eb60dde38f208565b395ceec235.dll
Size

48KB
MD5

4ab76e3e3e314d751a6dcccb3eab7d70
SHA1

6c1d44fe3ad5adeb5cd49185328544ec3c3bde61
SHA256

4a25c958928aa7f68ed18f962ff48b0a726e0eb60dde38f208565b395ceec235
SHA512

aa61757d7537066edb62b53774dd273aaa5309ee90905ccb86df6135dee8400f3add5009cd605abbbc87c84ede6c8d8d4d123b4d65660e63f153f73d114ef073
SSDEEP

768:koIUeR5z1sPgVIXgrL1LbF4FBAksGWbWL3hVv00CKvTid1OpP740aZ00u:zMjmPiIXuPIZsbbGVv00CK7OcHn

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 3684	2140	rundll32.exe	80
PID 2140 wrote to memory of 3684	2140	rundll32.exe	80
PID 2140 wrote to memory of 3684	2140	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4a25c958928aa7f68ed18f962ff48b0a726e0eb60dde38f208565b395ceec235.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4a25c958928aa7f68ed18f962ff48b0a726e0eb60dde38f208565b395ceec235.dll,#1
  2⤵
  PID:3684

memory/3684-133-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download