1c252ca82f48f1e3f85b9317781891245e69d2d66b90600b904ce96431e37192

Analysis

max time kernel
91s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 02:22

Target

1c252ca82f48f1e3f85b9317781891245e69d2d66b90600b904ce96431e37192.dll
Size

267KB
MD5

5385f6ad16ba53d984cf89aa0d796d97
SHA1

7d3bb0301362ffcf9885dc8c161fd246444bcb21
SHA256

1c252ca82f48f1e3f85b9317781891245e69d2d66b90600b904ce96431e37192
SHA512

3ddf78cd9a34a3f761031305300f4e36a60a4e25901b195591980aa190d77fca58fef14a70eb034a4d363690984877b7cfe85ec9615c35e9c4cdfe4bb2fb25ff
SSDEEP

6144:Zn46wsJIrCCwVwette322cmfGSwk/Nj1uni:Z463J2KCLOS

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5032 wrote to memory of 5024	5032	rundll32.exe	82
PID 5032 wrote to memory of 5024	5032	rundll32.exe	82
PID 5032 wrote to memory of 5024	5032	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1c252ca82f48f1e3f85b9317781891245e69d2d66b90600b904ce96431e37192.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1c252ca82f48f1e3f85b9317781891245e69d2d66b90600b904ce96431e37192.dll,#1
  2⤵
  PID:5024

memory/5024-133-0x0000000010000000-0x000000001001C000-memory.dmp

Filesize
112KB

Download