ad079811b79e07d9ff504ffc5f0354a1b5d19d677ddb54c7db27e2a8a4ddcf4b

Analysis

max time kernel
90s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
20-10-2022 03:23

Target

ad079811b79e07d9ff504ffc5f0354a1b5d19d677ddb54c7db27e2a8a4ddcf4b.dll
Size

83KB
MD5

46551ee1c9f79bfec2bf17ea30430db5
SHA1

3bc45596f431790a9edc2357b35f35869a41e488
SHA256

ad079811b79e07d9ff504ffc5f0354a1b5d19d677ddb54c7db27e2a8a4ddcf4b
SHA512

fad28f23ec932c8e18fd5cc9dd23dfb42a7a2601c64b0c85a1a1f1635145c9ede3ea2a94701bdb0228e5a7b4f4e995f7cf782a75c294a90625f35b9501db1577
SSDEEP

1536:siPXgpa5bDkDOFta3RluUlM+XGSP2GMNPO+H8oUxNvFGDsfqNwApeI8gv17:tgW3y3RFluGMtNcoS2HzpF

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 3752	5076	rundll32.exe	82
PID 5076 wrote to memory of 3752	5076	rundll32.exe	82
PID 5076 wrote to memory of 3752	5076	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ad079811b79e07d9ff504ffc5f0354a1b5d19d677ddb54c7db27e2a8a4ddcf4b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ad079811b79e07d9ff504ffc5f0354a1b5d19d677ddb54c7db27e2a8a4ddcf4b.dll,#1
  2⤵
  PID:3752

memory/3752-132-0x0000000000000000-mapping.dmp

Download
memory/3752-133-0x000000006D590000-0x000000006D5A9000-memory.dmp

Filesize
100KB

Download