3ba11733d119d947f8e0aace86132c15a00bf5d8ff9d57036bf502b90956ad9a

Analysis

max time kernel
152s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 19:36

Target

3ba11733d119d947f8e0aace86132c15a00bf5d8ff9d57036bf502b90956ad9a.dll
Size

116KB
MD5

30039cf2cfbdc3a7fc17867ed866fd00
SHA1

1ed6e41820304218a6c357bd65dbe3d46ef53178
SHA256

3ba11733d119d947f8e0aace86132c15a00bf5d8ff9d57036bf502b90956ad9a
SHA512

d6819d1b6d0363855305bb222d231caeadc32e7b1825752cae7d1ac2dceea7f0a2600030735bb5a80c7ad29231bb7547a95d8264b0b9a5f9cad05c3e48770b8e
SSDEEP

3072:lqw8YmvtVw92B9OAVTXDO6Rm6FXFrUFVJ:Kw09OAk2PXFwJ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4176 wrote to memory of 1420	4176	rundll32.exe	82
PID 4176 wrote to memory of 1420	4176	rundll32.exe	82
PID 4176 wrote to memory of 1420	4176	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ba11733d119d947f8e0aace86132c15a00bf5d8ff9d57036bf502b90956ad9a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4176
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ba11733d119d947f8e0aace86132c15a00bf5d8ff9d57036bf502b90956ad9a.dll,#1
  2⤵
  PID:1420

memory/1420-133-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/1420-134-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download