c4374026bec976169246716e25b848d6666ed011c05f654463bb2339bf319b35

Analysis

max time kernel
91s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
22/09/2022, 06:54

Target

c4374026bec976169246716e25b848d6666ed011c05f654463bb2339bf319b35.dll
Size

11KB
MD5

44677e8f61dfc48b1b326745216330ba
SHA1

f49a6c8d826b5341e83b6860f7cb5a59bc1152bf
SHA256

c4374026bec976169246716e25b848d6666ed011c05f654463bb2339bf319b35
SHA512

1d7804b75cb43af4c0dd66940a2efda727c2b71878fec9bbaa717ced13bb0966418ceaddb51e18097b4bcdd179bb390698a993278aadd40205b0f17bc3089819
SSDEEP

192:RR/KUt5m3v7JEveUCKG85Lxzbu9jvMl2N98MgK3dU0c/uhYhALq4hoxkTinfR14c://KTjJdSGILxuZ5Nntc/uecqqk5fR1AM

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4772 wrote to memory of 1060	4772	rundll32.exe	79
PID 4772 wrote to memory of 1060	4772	rundll32.exe	79
PID 4772 wrote to memory of 1060	4772	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c4374026bec976169246716e25b848d6666ed011c05f654463bb2339bf319b35.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c4374026bec976169246716e25b848d6666ed011c05f654463bb2339bf319b35.dll,#1
  2⤵
  PID:1060

memory/1060-133-0x0000000010000000-0x0000000010009000-memory.dmp

Filesize
36KB

Download