68dd3e1bea2de05dd308717f0d0199ce3516ab1ec2e7a1fe710158f9ae6d6fee

Analysis

max time kernel
147s
max time network
195s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/10/2022, 20:43

Target

68dd3e1bea2de05dd308717f0d0199ce3516ab1ec2e7a1fe710158f9ae6d6fee.dll
Size

343KB
MD5

664d6e7b21d44375d158d70548f35cbe
SHA1

d2734b774b18c6aefb2c420fafbf2cf8c7997a96
SHA256

68dd3e1bea2de05dd308717f0d0199ce3516ab1ec2e7a1fe710158f9ae6d6fee
SHA512

08915f8c3055a4db327ba553614090661b5467cd0a5c929895bea0988fbc4775a5b5a9723732fe266913551d43924f0a0a0d1159cab1594d00fd78c83c3959fa
SSDEEP

3072:R/+JR2BNtlt0ntfjNOVzV5kqTX0nj5XEAprAgSJUJP28ZulWsXbds:R/+JR2BNtlt0trN1nhEApkggqPHZLZ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4904 wrote to memory of 4872	4904	rundll32.exe	81
PID 4904 wrote to memory of 4872	4904	rundll32.exe	81
PID 4904 wrote to memory of 4872	4904	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\68dd3e1bea2de05dd308717f0d0199ce3516ab1ec2e7a1fe710158f9ae6d6fee.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\68dd3e1bea2de05dd308717f0d0199ce3516ab1ec2e7a1fe710158f9ae6d6fee.dll,#1
  2⤵
  PID:4872

memory/4872-133-0x0000000010000000-0x0000000010059000-memory.dmp

Filesize
356KB

Download