4b0f6e8b4304f96dc3c55777026c80fd593da1dd6eb1dfbf94926fb46d03a2df

Analysis

max time kernel
111s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 15:10

Target
4b0f6e8b4304f96dc3c55777026c80fd593da1dd6eb1dfbf94926fb46d03a2df.dll
Size 10KB
Sample221020-sj7k9abbc8
SHA256 4b0f6e8b4304f96dc3c55777026c80fd593da1dd6eb1dfbf94926fb46d03a2df
MD5 9035fb338bc27de004190896f85b79f4
SHA1 4fe48380ba4c6bf9f6d8a6eb2fc8f01caa701fd2
SHA512 165e9b6f4d33d8ff2282bf52c87289e3420d8238fede96e972d39adbddb094d5879b66628bd37bf5ed5a78c5c09ce80927fbbc0c1f1b44eb9be8708af9481d66
SSDEEP 192:41mjfw8dHabRDEgzHyl0NSyFWakiP84dW3qWak8Q7dW3o92b:48jhdHad/z20IyFWakC84dWaWak8cdWj
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2560 wrote to memory of 4164	2560	rundll32.exe	82
PID 2560 wrote to memory of 4164	2560	rundll32.exe	82
PID 2560 wrote to memory of 4164	2560	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4b0f6e8b4304f96dc3c55777026c80fd593da1dd6eb1dfbf94926fb46d03a2df.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4b0f6e8b4304f96dc3c55777026c80fd593da1dd6eb1dfbf94926fb46d03a2df.dll,#1
  2⤵
  PID:4164

memory/4164-133-0x000000006DD21000-0x000000006DD23000-memory.dmp

Download