fd42abca1ba1951f3594c73c1115b92cb7fad67c2a137c1224e8370510c78746

Analysis

max time kernel
147s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04-10-2022 06:37

Target

fd42abca1ba1951f3594c73c1115b92cb7fad67c2a137c1224e8370510c78746.dll
Size

10KB
MD5

392e84f3f6691abd53426a43845b4e33
SHA1

5d8190cdc91d41fe7998650806c5b977f62c8526
SHA256

fd42abca1ba1951f3594c73c1115b92cb7fad67c2a137c1224e8370510c78746
SHA512

2488ac522f6ec231a239e48e65a321182b28c1d4a7f885063b052ec52c6c6a7f56f232b1ab700ead2a1dc3686ec9c7a4bed6055d4db899439c133c3494473e55
SSDEEP

192:Sw8dHabRDEgtHyl0NSypWak6HVdW3yWak8QjdW3w92b:6dHad/N20IypWak8dWiWak8EdW7

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4072 wrote to memory of 2216	4072	rundll32.exe	82
PID 4072 wrote to memory of 2216	4072	rundll32.exe	82
PID 4072 wrote to memory of 2216	4072	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fd42abca1ba1951f3594c73c1115b92cb7fad67c2a137c1224e8370510c78746.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4072
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fd42abca1ba1951f3594c73c1115b92cb7fad67c2a137c1224e8370510c78746.dll,#1
  2⤵
  PID:2216

memory/2216-132-0x0000000000000000-mapping.dmp

Download
memory/2216-133-0x000000006DD21000-0x000000006DD23000-memory.dmp

Filesize
8KB

Download