684af54c3fa4bfc2b70975071f4aed177a5c0a2fde77b9eef2f258c035303185

Analysis

max time kernel
91s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
08/10/2022, 18:48

Target

684af54c3fa4bfc2b70975071f4aed177a5c0a2fde77b9eef2f258c035303185.dll
Size

536KB
MD5

5d460ed80d14d95f586da434ff384bb8
SHA1

4f9a16c884c4b1381bada6d94496bf635ebe7d77
SHA256

684af54c3fa4bfc2b70975071f4aed177a5c0a2fde77b9eef2f258c035303185
SHA512

b86b8109a6bb4ff17f534605321018f7a603ec50d5dc2bf8a9dc1bbb52a1a20f71150bead34a0bd891a06d74224d9ab3b679a0e0f739fa6cb8a990122fd4323a
SSDEEP

6144:gBWiCLsdU/HqL/mSuuUJ/UwnYvxtO9uDaAJD9Zgya48M7eaK6Uc542hDJ4mHMEIM:WCLspL/mwZtldxZgKeafUhc4mgiMY1

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 764 wrote to memory of 4844	764	rundll32.exe	82
PID 764 wrote to memory of 4844	764	rundll32.exe	82
PID 764 wrote to memory of 4844	764	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\684af54c3fa4bfc2b70975071f4aed177a5c0a2fde77b9eef2f258c035303185.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:764
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\684af54c3fa4bfc2b70975071f4aed177a5c0a2fde77b9eef2f258c035303185.dll,#1
  2⤵
  PID:4844

memory/4844-133-0x0000000000C50000-0x0000000000CDB000-memory.dmp

Filesize
556KB

Download