d9c77738e310814de6d50a3023106951c5b443f637c7e306dce7341adca313a5

Analysis

max time kernel
169s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 00:36

Target

d9c77738e310814de6d50a3023106951c5b443f637c7e306dce7341adca313a5.dll
Size

144KB
MD5

6fa382c36fde4920cabed17352bfb4a8
SHA1

a0a66f0dea61038d6ae0a798d61f731f2ecc5af1
SHA256

d9c77738e310814de6d50a3023106951c5b443f637c7e306dce7341adca313a5
SHA512

d2704bd61673ec957ec2bb75667cdd21d2b1fa740ffb12fa5c39a57831ebe9d73bd983dd838d67651d847c4cd8e277104e92019288baa4ac55772e19416510e7
SSDEEP

1536:/IcMIlIjkuvfZ/AuwHPNAnlFdyqcgzjNaASP0xOePV8AgH:/ey8xvfGH2RQJ0xO48Ag

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4980 wrote to memory of 4208	4980	rundll32.exe	81
PID 4980 wrote to memory of 4208	4980	rundll32.exe	81
PID 4980 wrote to memory of 4208	4980	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d9c77738e310814de6d50a3023106951c5b443f637c7e306dce7341adca313a5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4980
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d9c77738e310814de6d50a3023106951c5b443f637c7e306dce7341adca313a5.dll,#1
  2⤵
  PID:4208

memory/4208-134-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download