0d9cd0f893c1cf87e7cc96b92757cf9a2d5a9ecbc0c22ea9d66b89df71bb96eb

Analysis

max time kernel
91s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
01/10/2022, 20:42

Target

0d9cd0f893c1cf87e7cc96b92757cf9a2d5a9ecbc0c22ea9d66b89df71bb96eb.dll
Size

207KB
MD5

642d0bd5abc1c742bf9d3c47dffe4e4d
SHA1

1d685a6594fc04427588f1aadee87515ad7690c3
SHA256

0d9cd0f893c1cf87e7cc96b92757cf9a2d5a9ecbc0c22ea9d66b89df71bb96eb
SHA512

b146dcf72820d4855ce0a1000832ffb65fd5343e1511cdb72460554a9078a3e073cc75d3aca3559e1f12234c64c4ee88197ba3d9c1a75bfe46a9ea0233a9298d
SSDEEP

3072:PK/yxvfGR9tsNBhzB1EzYNkKI2EJWvuzRDlRmDMona:PK/QfqXCjV1UYNk9gvuN3P

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 4340	2192	rundll32.exe	84
PID 2192 wrote to memory of 4340	2192	rundll32.exe	84
PID 2192 wrote to memory of 4340	2192	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0d9cd0f893c1cf87e7cc96b92757cf9a2d5a9ecbc0c22ea9d66b89df71bb96eb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0d9cd0f893c1cf87e7cc96b92757cf9a2d5a9ecbc0c22ea9d66b89df71bb96eb.dll,#1
  2⤵
  PID:4340

memory/4340-133-0x0000000010000000-0x0000000010040000-memory.dmp

Filesize
256KB

Download