959d27ae3ef0ecf307da6fe08a6f105e07500ca3d9816cf19fecd878529db7f3

Analysis

max time kernel
151s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 13:51

Target

959d27ae3ef0ecf307da6fe08a6f105e07500ca3d9816cf19fecd878529db7f3.dll
Size

101KB
MD5

672b51cdf3607f801cc98d66b294d6b0
SHA1

b05a40d37e41e1423b80b84420e079be20908fc8
SHA256

959d27ae3ef0ecf307da6fe08a6f105e07500ca3d9816cf19fecd878529db7f3
SHA512

cc43494914b75a245082326e6ad6fba6d5f05f151e3479fe99c233864d393ed033a6acd7b940d769c42800b18c1225ec386e2723f323b1bfb9bc7ea7f2ec30d4
SSDEEP

1536:YkSMScMwX+LxLeMVet5ozdKr1gRE5RyOFp878hKyWdA4IVifW:YRMRMu+sMVkoEr+OyObE8hKyWnNW

Score

8^/10

Blocklisted process makes network request 4 IoCs

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\PROGRA~3\RUNDLL32.EXE-3372.txt	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5044 wrote to memory of 3372	5044	rundll32.exe	84
PID 5044 wrote to memory of 3372	5044	rundll32.exe	84
PID 5044 wrote to memory of 3372	5044	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\959d27ae3ef0ecf307da6fe08a6f105e07500ca3d9816cf19fecd878529db7f3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\959d27ae3ef0ecf307da6fe08a6f105e07500ca3d9816cf19fecd878529db7f3.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Drops file in Program Files directory
  PID:3372

memory/3372-133-0x000000000B000000-0x000000000B01F000-memory.dmp

Filesize
124KB

Download