0036bb88b8f74c5a9e2395ff5971500ec5aa4a6a21bafc7de790d2523769ec5e

Analysis

max time kernel
88s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 02:27

Target

0036bb88b8f74c5a9e2395ff5971500ec5aa4a6a21bafc7de790d2523769ec5e.dll
Size

10KB
MD5

6c84118c7b8dd3e784a3c1124865b287
SHA1

2854038cad6cd8bb4fed894517b70769e4518a46
SHA256

0036bb88b8f74c5a9e2395ff5971500ec5aa4a6a21bafc7de790d2523769ec5e
SHA512

9e281fe7bb52f8af7932472d6f390a5459c2945c3abe4c372f2c13c20be0fa27a425caf8bb798451800cc1bd3323853af17be2e2f2dd56a83de85f9d4254fc99
SSDEEP

192:Sw8dHabRDEgtHyl0NSypWak6HVdW3yWak8QjdW3w92b:6dHad/N20IypWak8dWiWak8EdW7

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 4752	2116	rundll32.exe	85
PID 2116 wrote to memory of 4752	2116	rundll32.exe	85
PID 2116 wrote to memory of 4752	2116	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0036bb88b8f74c5a9e2395ff5971500ec5aa4a6a21bafc7de790d2523769ec5e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0036bb88b8f74c5a9e2395ff5971500ec5aa4a6a21bafc7de790d2523769ec5e.dll,#1
  2⤵
  PID:4752

memory/4752-133-0x000000006DD21000-0x000000006DD23000-memory.dmp

Filesize
8KB

Download