2900db59d2bc0e75f24d47c9fb99ff8dbcddbc9646422a57f058c12dce76a76c

Analysis

max time kernel
115s
max time network
181s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04-10-2022 06:39

Target

2900db59d2bc0e75f24d47c9fb99ff8dbcddbc9646422a57f058c12dce76a76c.dll
Size

9KB
MD5

4305c2ed1f3111f53b47b8c7f6e0a20f
SHA1

cb78e3937642530b855962d2f3397981f74d3f7a
SHA256

2900db59d2bc0e75f24d47c9fb99ff8dbcddbc9646422a57f058c12dce76a76c
SHA512

580e2493ead510a6e96a2416d075c0a23d8bcf1029f153ab4030d9717160b6faabd90bce0fa1d4ceb34737d223624200469449da3a172c1a8c4c3721591068fc
SSDEEP

192:Iw8dHabRDEgtHyl0NSypWak6HVdW3yWak8QjdW3w97:4dHad/N20IypWak8dWiWak8EdWM

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4772 wrote to memory of 1124	4772	rundll32.exe	10
PID 4772 wrote to memory of 1124	4772	rundll32.exe	10
PID 4772 wrote to memory of 1124	4772	rundll32.exe	10

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2900db59d2bc0e75f24d47c9fb99ff8dbcddbc9646422a57f058c12dce76a76c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2900db59d2bc0e75f24d47c9fb99ff8dbcddbc9646422a57f058c12dce76a76c.dll,#1
  2⤵
  PID:1124

memory/1124-133-0x000000006DD21000-0x000000006DD23000-memory.dmp

Filesize
8KB

Download