21c23a9c0680b1c5fadba5beee8f84a6481f809163317b1fa9d66cf1a13c2a5b

Analysis

max time kernel
157s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 22:46

Target

21c23a9c0680b1c5fadba5beee8f84a6481f809163317b1fa9d66cf1a13c2a5b.dll
Size

215KB
MD5

62723f52d90d9e48192ece091527cd35
SHA1

b838194ab7989ef0edb92f9fba8c47fa996f7e57
SHA256

21c23a9c0680b1c5fadba5beee8f84a6481f809163317b1fa9d66cf1a13c2a5b
SHA512

becd79ba187a30f1affba8db722b5002389ebfa76b12ef286b1c173556d205f2ddced419240db308f0c066bd96139b276da5715c12bb42487e8aee9bb1610622
SSDEEP

3072:Sae1d84o4nwSPzGVS4aEWK+eEfftySI3AY1QayvwxjJBLiuw2do8LUTncp9lsZzo:76XtrOt5Jxfw2dHLUIpDCzi5ijC

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3136 wrote to memory of 4548	3136	rundll32.exe	78
PID 3136 wrote to memory of 4548	3136	rundll32.exe	78
PID 3136 wrote to memory of 4548	3136	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\21c23a9c0680b1c5fadba5beee8f84a6481f809163317b1fa9d66cf1a13c2a5b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3136
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\21c23a9c0680b1c5fadba5beee8f84a6481f809163317b1fa9d66cf1a13c2a5b.dll,#1
  2⤵
  PID:4548

memory/4548-133-0x0000000010000000-0x000000001003A000-memory.dmp

Filesize
232KB

Download