fb12dca23d34ded3ea96c272bd84c1c677c37a6bb9b4b16052fbf4ef6ca3039d

Analysis

max time kernel
148s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 23:35

Target

fb12dca23d34ded3ea96c272bd84c1c677c37a6bb9b4b16052fbf4ef6ca3039d.dll
Size

140KB
MD5

611cfcdbb8594d098a2d1108f5207a7d
SHA1

ba79911ec073a83cce7d7f2d88eb34121a7889ac
SHA256

fb12dca23d34ded3ea96c272bd84c1c677c37a6bb9b4b16052fbf4ef6ca3039d
SHA512

ccae1cf2b95a3b200815e12b359824dc733e9920ac24cff883056ca3c6a7af09bb00b1ed9803604c13e4decd393618662d9b507707c26019e8dac782481864ec
SSDEEP

1536:ZOQhoPdpp+rw9O5apNHQRQzhASxEPlLW5TFTdzF3oVFPNSQ0Of:G4wMQrnzhASxEPlq5vJ3oVF8Q0O

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 5064	3008	rundll32.exe	80
PID 3008 wrote to memory of 5064	3008	rundll32.exe	80
PID 3008 wrote to memory of 5064	3008	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fb12dca23d34ded3ea96c272bd84c1c677c37a6bb9b4b16052fbf4ef6ca3039d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fb12dca23d34ded3ea96c272bd84c1c677c37a6bb9b4b16052fbf4ef6ca3039d.dll,#1
  2⤵
  PID:5064

memory/5064-133-0x0000000010000000-0x000000001002C000-memory.dmp

Filesize
176KB

Download
memory/5064-134-0x0000000000FF0000-0x0000000000FFA000-memory.dmp

Filesize
40KB

Download
memory/5064-138-0x0000000010000000-0x000000001002C000-memory.dmp

Filesize
176KB

Download