a8b2b70d2a688af6466e7d6eae770fb9e2c7256240e71624644e16eaaf5dde2f

Analysis

max time kernel
94s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2022, 01:32

Target

a8b2b70d2a688af6466e7d6eae770fb9e2c7256240e71624644e16eaaf5dde2f.dll
Size

69KB
MD5

08596a9f5dc0cb9659501201badec990
SHA1

9f68373a701aa651dd81af917ba62d317096a36b
SHA256

a8b2b70d2a688af6466e7d6eae770fb9e2c7256240e71624644e16eaaf5dde2f
SHA512

0fb7d7d1803f3c1c3bc4908ee7184be07fb7f0e064df0843f83c6900d4ba773a08cbc53a6003dd87ebfe6fdcb2777602610f60806e08ab2289463ed3b68b54b9
SSDEEP

1536:9ccpdP6D3sk+Hh2uhzGXX4gDLxWgjPI/DdrEo+a20asZJNO8xucb:9FkJu0YgDdW0I7drEoLystr

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5020 wrote to memory of 596	5020	rundll32.exe	80
PID 5020 wrote to memory of 596	5020	rundll32.exe	80
PID 5020 wrote to memory of 596	5020	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a8b2b70d2a688af6466e7d6eae770fb9e2c7256240e71624644e16eaaf5dde2f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a8b2b70d2a688af6466e7d6eae770fb9e2c7256240e71624644e16eaaf5dde2f.dll,#1
  2⤵
  PID:596

memory/596-133-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download