66fbd251523f00ee3bb6febef5d1df8d98a0e655bf6b98dd0759e2d4aa74d9f2

Analysis

max time kernel
145s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-10-2022 07:04

Target

66fbd251523f00ee3bb6febef5d1df8d98a0e655bf6b98dd0759e2d4aa74d9f2.dll
Size

6KB
MD5

56994005700625e2eebbdb99fc5aec14
SHA1

17db7cfdcd0db0d705ac4c691f4b94574352c3f5
SHA256

66fbd251523f00ee3bb6febef5d1df8d98a0e655bf6b98dd0759e2d4aa74d9f2
SHA512

f67aac1b6ca3f4cdfbdfe4c944aff9a2f89062abf78dccc6f7308ae335de8ae4d2d5010bfcbd5142fd9efeb3c98c10f6376b221b4bb6ce38f1ddb1521f9e1c80
SSDEEP

48:a7S4sM1H6q3/wfCnoo8+Z5aFJkvhL1Te6ZWvEOURM9hQ5WV2SxXbXHI5yLVm9G/t:kRx5ob+7mJk5gyWMRmEWVHb

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 2208	1584	rundll32.exe	80
PID 1584 wrote to memory of 2208	1584	rundll32.exe	80
PID 1584 wrote to memory of 2208	1584	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\66fbd251523f00ee3bb6febef5d1df8d98a0e655bf6b98dd0759e2d4aa74d9f2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\66fbd251523f00ee3bb6febef5d1df8d98a0e655bf6b98dd0759e2d4aa74d9f2.dll,#1
  2⤵
  PID:2208

memory/2208-133-0x0000000073E40000-0x0000000073E45000-memory.dmp

Filesize
20KB

Download