bebe1f11b18fecfb4df238437051d5ddeff7a20a6191b57dc5b3b5bcc6248999

Analysis

max time kernel
100s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2022, 04:49

Target

bebe1f11b18fecfb4df238437051d5ddeff7a20a6191b57dc5b3b5bcc6248999.dll
Size

160KB
MD5

64a59953a750b94e7daee2e6128215c6
SHA1

9d015e88ddc621243277b78809b551527638378a
SHA256

bebe1f11b18fecfb4df238437051d5ddeff7a20a6191b57dc5b3b5bcc6248999
SHA512

994917d310ea456bff46fb4bd5016d3831943dbd446121a97b9cb93d853a1e250bb9484d575f50763ac5f80d1bffa06748bb080f1c223fea0cc206ea90ebaa17
SSDEEP

3072:+NA8wH3QSLR+IxSbAc3gklQKS2zVWgoOpm:8A8oAAnSbAcnCKJHogm

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 4320	2548	rundll32.exe	80
PID 2548 wrote to memory of 4320	2548	rundll32.exe	80
PID 2548 wrote to memory of 4320	2548	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bebe1f11b18fecfb4df238437051d5ddeff7a20a6191b57dc5b3b5bcc6248999.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bebe1f11b18fecfb4df238437051d5ddeff7a20a6191b57dc5b3b5bcc6248999.dll,#1
  2⤵
  PID:4320

memory/4320-133-0x0000000061B10000-0x0000000061B3A000-memory.dmp

Filesize
168KB

Download
memory/4320-134-0x0000000061B10000-0x0000000061B3A000-memory.dmp

Filesize
168KB

Download