2d3b2b0bc2eef292e9d56d38b38bde237ca9fb6df29aad539b086e0d823000bc

Analysis

max time kernel
186s
max time network
201s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/10/2022, 13:54

Target

2d3b2b0bc2eef292e9d56d38b38bde237ca9fb6df29aad539b086e0d823000bc.dll
Size

10KB
MD5

a1bc448e8264934b82a637bddd42c83f
SHA1

4283f461587d9c633fac1e8100995de7fe30df9b
SHA256

2d3b2b0bc2eef292e9d56d38b38bde237ca9fb6df29aad539b086e0d823000bc
SHA512

f4e4e8168c7f4d7499bb836a80d95bbd1af704a510939dc82f7aa43349dd04073adad99069af8d0e06337ac4c04ab6732e3180bdb341d1a9ace48c99f50c20d2
SSDEEP

192:Sw8dHabRDEgtHyl0NSypWak6HVdW3yWak8QjdW3w92b:6dHad/N20IypWak8dWiWak8EdW7

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 652 wrote to memory of 3428	652	rundll32.exe	80
PID 652 wrote to memory of 3428	652	rundll32.exe	80
PID 652 wrote to memory of 3428	652	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2d3b2b0bc2eef292e9d56d38b38bde237ca9fb6df29aad539b086e0d823000bc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:652
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2d3b2b0bc2eef292e9d56d38b38bde237ca9fb6df29aad539b086e0d823000bc.dll,#1
  2⤵
  PID:3428

memory/3428-133-0x000000006DD21000-0x000000006DD23000-memory.dmp

Filesize
8KB

Download
memory/3428-134-0x000000006DD20000-0x000000006DD27000-memory.dmp

Filesize
28KB

Download