979f769af001cac705174207a15e5dac3ba924a04ecf2913c7464b7fc73d05c5

Analysis

max time kernel
72s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 15:30

Target

979f769af001cac705174207a15e5dac3ba924a04ecf2913c7464b7fc73d05c5.dll
Size

18KB
MD5

968ba226e2249f8fa382f9852c2e4380
SHA1

d255ed93393e10fff6a48f2689de0727f47b1b4d
SHA256

979f769af001cac705174207a15e5dac3ba924a04ecf2913c7464b7fc73d05c5
SHA512

9f5fb7519d7f3cc7f12e439bb22668c65a090563a60379fc2563fb36c3cede0d2d10179121ef400b9b57dd5c649c16984bbe446161550e78d86d501df9467c6a
SSDEEP

384:9uCiGC+GoC37M6F0yWqYkD68PyR+zCru60viv0U:9ZiO27MUWXkvyR++ruXv+R

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4496 wrote to memory of 4244	4496	rundll32.exe	74
PID 4496 wrote to memory of 4244	4496	rundll32.exe	74
PID 4496 wrote to memory of 4244	4496	rundll32.exe	74

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\979f769af001cac705174207a15e5dac3ba924a04ecf2913c7464b7fc73d05c5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4496
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\979f769af001cac705174207a15e5dac3ba924a04ecf2913c7464b7fc73d05c5.dll,#1
  2⤵
  PID:4244

memory/4244-133-0x0000000077BA0000-0x0000000077BA7000-memory.dmp

Filesize
28KB

Download