bc22459dd121ca5506bd77456b900739244e8832c524b4fb0c6af401e5795d1b

Analysis

max time kernel
133s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02-10-2022 11:34

Target

bc22459dd121ca5506bd77456b900739244e8832c524b4fb0c6af401e5795d1b.dll
Size

61KB
MD5

7777750576520cd01f984601d5435fce
SHA1

1574d161f63e14ad6ef675c52b47cbf333df75ad
SHA256

bc22459dd121ca5506bd77456b900739244e8832c524b4fb0c6af401e5795d1b
SHA512

7072042a17ba84a48b066466ea549c6b9f8e31219c9b885e804cea6cfdaab1de4cbb67b3ce513f957734800998d09bd08e404255a4a44a87fda549fe5aa5e086
SSDEEP

1536:lcxQo2Zt1ATllrOpab+1N7+pZ/TyTWRsdWy:l5ogtap8pxj761TyTS

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4988 wrote to memory of 2040	4988	rundll32.exe	84
PID 4988 wrote to memory of 2040	4988	rundll32.exe	84
PID 4988 wrote to memory of 2040	4988	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bc22459dd121ca5506bd77456b900739244e8832c524b4fb0c6af401e5795d1b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bc22459dd121ca5506bd77456b900739244e8832c524b4fb0c6af401e5795d1b.dll,#1
  2⤵
  PID:2040

memory/2040-132-0x0000000000000000-mapping.dmp

Download
memory/2040-133-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download