bd0c900448c183101bb3d4b5788d73a6c925410f9be8e5f4eae6f1dd2ab8cd63

Analysis

max time kernel
104s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 15:52

Target

bd0c900448c183101bb3d4b5788d73a6c925410f9be8e5f4eae6f1dd2ab8cd63.dll
Size

268KB
MD5

733b2312191a7feffb243c2f8fb58057
SHA1

d1537bb80ad143205f8abc6d4446fecaa0e5e488
SHA256

bd0c900448c183101bb3d4b5788d73a6c925410f9be8e5f4eae6f1dd2ab8cd63
SHA512

6bf2b3585626d632698816eb9232c97d2c57923dfa631ec111072b6eba51912e94a0934fe18f51bd46f92dae4daf107767579ae0dbd7b18b9f0403cd5162373d
SSDEEP

3072:XXWoz1Ah0c2KUbHCEUqfZdVBNbsjCqAJq257VoNyTCCm2lMPZqH0:XXWozQ07HBfCC1MPZ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4828 wrote to memory of 4756	4828	rundll32.exe	81
PID 4828 wrote to memory of 4756	4828	rundll32.exe	81
PID 4828 wrote to memory of 4756	4828	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd0c900448c183101bb3d4b5788d73a6c925410f9be8e5f4eae6f1dd2ab8cd63.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd0c900448c183101bb3d4b5788d73a6c925410f9be8e5f4eae6f1dd2ab8cd63.dll,#1
  2⤵
  PID:4756

memory/4756-133-0x0000000010000000-0x0000000010047000-memory.dmp

Filesize
284KB

Download