66b9af54aeebbe73348302f0ee4069cf37afe6f859525fefdaf158d56ffba25e

Analysis

max time kernel
138s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 00:09

Target

66b9af54aeebbe73348302f0ee4069cf37afe6f859525fefdaf158d56ffba25e.dll
Size

600KB
MD5

62b8f8ce549584f1a49b4fbad4d3ce00
SHA1

8ab1b24b34a84d70623080de4daa393aab538bf2
SHA256

66b9af54aeebbe73348302f0ee4069cf37afe6f859525fefdaf158d56ffba25e
SHA512

3ddb7fbd9acabb33b8f0c3820290a295d25cae63be3f15e1415a62b5537cc4c1bce6d82b90163c38509d5198fae9ca22adfb356df5465548389e6f7b73af6152
SSDEEP

12288:DN5Lni72+F+/SvQsGHczF9gaL122xXTXP37vFzbH0nCGtNJvmImuWN:742+JYsVz7wtNFWuu

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4984 wrote to memory of 4968	4984	rundll32.exe	84
PID 4984 wrote to memory of 4968	4984	rundll32.exe	84
PID 4984 wrote to memory of 4968	4984	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\66b9af54aeebbe73348302f0ee4069cf37afe6f859525fefdaf158d56ffba25e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4984
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\66b9af54aeebbe73348302f0ee4069cf37afe6f859525fefdaf158d56ffba25e.dll,#1
  2⤵
  PID:4968

memory/4968-133-0x0000000010000000-0x0000000010097000-memory.dmp

Filesize
604KB

Download