48a88f571ec503611581a377501bdfef442c9ca73471b10deabfb2e516c0c885

Analysis

max time kernel
140s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20-10-2022 12:37

Target

48a88f571ec503611581a377501bdfef442c9ca73471b10deabfb2e516c0c885.dll
Size

190KB
MD5

a002bed4aa3b4da8b287f3963edd02f0
SHA1

720460948af4771ed728696fabc61be5982b7659
SHA256

48a88f571ec503611581a377501bdfef442c9ca73471b10deabfb2e516c0c885
SHA512

ea8a17a59b86d2085cc4bab6eedd8c4c12cf1a929c80859b8afb2754af861e1e08e221124541abcfae7f6f6bfc73663aa79784d8d04fcc1714702e67effa4d0c
SSDEEP

3072:6xes1L7Nap5sPGqOyaZySXBZe52uEy5egY6sQiiLZUvZ8StQyw:68sTmZqOyahXq52E7sUZUZ8ww

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 5044	2432	rundll32.exe	84
PID 2432 wrote to memory of 5044	2432	rundll32.exe	84
PID 2432 wrote to memory of 5044	2432	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\48a88f571ec503611581a377501bdfef442c9ca73471b10deabfb2e516c0c885.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\48a88f571ec503611581a377501bdfef442c9ca73471b10deabfb2e516c0c885.dll,#1
  2⤵
  PID:5044

memory/5044-133-0x0000000010000000-0x0000000010032000-memory.dmp

Filesize
200KB

Download