4b0c480e1c7b71e5238ab7b4e5e6bb860a7c671618833199ce490fa4a23d135c

Analysis

max time kernel
90s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 02:22

Target

4b0c480e1c7b71e5238ab7b4e5e6bb860a7c671618833199ce490fa4a23d135c.dll
Size

73KB
MD5

5e5209396c37957e9be9a20103db606b
SHA1

32d0619cacf0484f35100b35058889bcfcc4745b
SHA256

4b0c480e1c7b71e5238ab7b4e5e6bb860a7c671618833199ce490fa4a23d135c
SHA512

4c95f9bf86ee5317deccf48c787d044257e2a9f60a5370f7939e46aef60d977890d8ff16dd6dcdad295445d7bb6eb4716370fd047cbe34d659837c0ae16fd4b5
SSDEEP

1536:Frm4jQ66HFAvGFb7e+MkAWQ0NoYhobUo9+v95TrA2UEe4Z8E4yqyot1E:tm0yGm+gAWQ+hHokF5Y2UDi8E4yTot1E

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 640 wrote to memory of 1500	640	rundll32.exe	82
PID 640 wrote to memory of 1500	640	rundll32.exe	82
PID 640 wrote to memory of 1500	640	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4b0c480e1c7b71e5238ab7b4e5e6bb860a7c671618833199ce490fa4a23d135c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:640
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4b0c480e1c7b71e5238ab7b4e5e6bb860a7c671618833199ce490fa4a23d135c.dll,#1
  2⤵
  PID:1500

memory/1500-133-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download