ff5ffc75b32c3110f7d95fd329d4dccad07931608cd6d90be33576a76dfb54b0

Analysis

max time kernel
229s
max time network
241s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2022, 17:14

Target

ff5ffc75b32c3110f7d95fd329d4dccad07931608cd6d90be33576a76dfb54b0.dll
Size

61KB
MD5

6ef272a5c04f33830b35c3d4f3552873
SHA1

a9fb9246fdb43b2fd4858cefc7e9ce25f5eeb29c
SHA256

ff5ffc75b32c3110f7d95fd329d4dccad07931608cd6d90be33576a76dfb54b0
SHA512

908d0ca21400fc7745c2fcd274fc88a5462f972d2cb53fd840e6da19eb7c3f50bb09112db8a07d0cfc214cfeed902c4b52dc56d79032c848faf175bede027c10
SSDEEP

1536:x9AVRU28lDFfpSTjZqgwkNWUth/uoTdJy8HlH1cq5ptg:x9AV628z6l5DtBjTjy8HlHO/

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 3820	1712	rundll32.exe	81
PID 1712 wrote to memory of 3820	1712	rundll32.exe	81
PID 1712 wrote to memory of 3820	1712	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ff5ffc75b32c3110f7d95fd329d4dccad07931608cd6d90be33576a76dfb54b0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ff5ffc75b32c3110f7d95fd329d4dccad07931608cd6d90be33576a76dfb54b0.dll,#1
  2⤵
  PID:3820

memory/3820-133-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download