1480777c361ac1d398cc26c90215de629733f66d60dcbd5970700db0ce786ae1

Resubmissions

27-10-2022 16:05

20-10-2022 21:03

max time kernel
90s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
20-10-2022 21:03

Target

1480777c361ac1d398cc26c90215de629733f66d60dcbd5970700db0ce786ae1.dll
Size

973KB
MD5

8c658b9b02814927124351484c42a272
SHA1

85c346b2d6d0306a5bf7f276e82d9984c167e8ea
SHA256

1480777c361ac1d398cc26c90215de629733f66d60dcbd5970700db0ce786ae1
SHA512

28f9fcd72e5beceef4e7442e7bac02c0b5060c71403af34aabb78f4871c28bfdf88f4a50da8988fbbc07429466db6c05dd4f3292cabedf913ccbd532086deba3
SSDEEP

12288:bDDjN50jO7rPxxYnCOWMrZlTf6ahp+3NV6ZZveATYAyvPzXTwnX1cQ47gcckpPWy:/vf3ZKnZDyYxr6AVIY7wOM058ZxM

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1344 wrote to memory of 4816	1344	rundll32.exe	rundll32.exe
PID 1344 wrote to memory of 4816	1344	rundll32.exe	rundll32.exe
PID 1344 wrote to memory of 4816	1344	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1480777c361ac1d398cc26c90215de629733f66d60dcbd5970700db0ce786ae1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1480777c361ac1d398cc26c90215de629733f66d60dcbd5970700db0ce786ae1.dll,#1
  2⤵
  PID:4816

memory/4816-132-0x0000000000000000-mapping.dmp

Download
memory/4816-133-0x0000000002850000-0x0000000002948000-memory.dmp

Filesize
992KB

Download
memory/4816-134-0x0000000002B60000-0x0000000002B6E000-memory.dmp

Filesize
56KB

Download
memory/4816-135-0x0000000002B80000-0x0000000002B8F000-memory.dmp

Filesize
60KB

Download