29907460310919f5bd2e7c642cf7756662ead06ec22b88f085945762517bd6d7

Analysis

max time kernel
144s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2022, 04:57

Target

29907460310919f5bd2e7c642cf7756662ead06ec22b88f085945762517bd6d7.dll
Size

256KB
MD5

64779a3a2b8e2ac468cf9ac5be3f3779
SHA1

c7c7e4ac8640269cea60fbd489b86b922cbe5d26
SHA256

29907460310919f5bd2e7c642cf7756662ead06ec22b88f085945762517bd6d7
SHA512

f7f7c786d931702d09329d5e198a79bd234f3556d31702f462e96bbc7470ba6674ee141b34030cea99b78ff8d8a62133511e6e002d29492e0886c7bd7f7554ac
SSDEEP

6144:89+GjQ11mKsE9zZtGzfliDPIdxU5i0XUJAFxhln+YkF:XGimOZKAjKLApl+YkF

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 3900	2748	rundll32.exe	82
PID 2748 wrote to memory of 3900	2748	rundll32.exe	82
PID 2748 wrote to memory of 3900	2748	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\29907460310919f5bd2e7c642cf7756662ead06ec22b88f085945762517bd6d7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\29907460310919f5bd2e7c642cf7756662ead06ec22b88f085945762517bd6d7.dll,#1
  2⤵
  PID:3900

memory/3900-133-0x0000000010000000-0x0000000010040000-memory.dmp

Filesize
256KB

Download