ea732dde359cf9c36aca24861d232f8702d2ef8619519bcc50a3939b19f1cfcb

Analysis

max time kernel
83s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-10-2022 14:02

Target

1720-57-0x0000000000450000-0x0000000000479000-memory.dll
Size

164KB
MD5

3086b650859e6983cd1af0681d3df7d7
SHA1

512fb5e9f2ea72dec2448f9b687d45f439c245bf
SHA256

ea732dde359cf9c36aca24861d232f8702d2ef8619519bcc50a3939b19f1cfcb
SHA512

899ceb672e03fda9127eade1aedf16ebb92c975c485d39003a8d81a9970f0fe7cd80a0cb8fcaf4c57f59490be2bd1517994d9a1556aae3b72d641abec3e83e24
SSDEEP

3072:/rLt4lA1fWpcqhAdJXGFnLTBfJVy3AO/ya:DR421fWlKdJWFnLTBBU3j/

Score

1^/10

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

rundll32.exerundll32.exerundll32.exerundll32.exerundll32.exe

description	pid	process	target process
PID 3452 wrote to memory of 952	3452	rundll32.exe	rundll32.exe
PID 3452 wrote to memory of 952	3452	rundll32.exe	rundll32.exe
PID 3452 wrote to memory of 952	3452	rundll32.exe	rundll32.exe
PID 952 wrote to memory of 1304	952	rundll32.exe	rundll32.exe
PID 952 wrote to memory of 1304	952	rundll32.exe	rundll32.exe
PID 952 wrote to memory of 1304	952	rundll32.exe	rundll32.exe
PID 1304 wrote to memory of 1256	1304	rundll32.exe	rundll32.exe
PID 1304 wrote to memory of 1256	1304	rundll32.exe	rundll32.exe
PID 1304 wrote to memory of 1256	1304	rundll32.exe	rundll32.exe
PID 1256 wrote to memory of 4852	1256	rundll32.exe	rundll32.exe
PID 1256 wrote to memory of 4852	1256	rundll32.exe	rundll32.exe
PID 1256 wrote to memory of 4852	1256	rundll32.exe	rundll32.exe
PID 4852 wrote to memory of 1428	4852	rundll32.exe	rundll32.exe
PID 4852 wrote to memory of 1428	4852	rundll32.exe	rundll32.exe
PID 4852 wrote to memory of 1428	4852	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1720-57-0x0000000000450000-0x0000000000479000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3452

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1720-57-0x0000000000450000-0x0000000000479000-memory.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:952

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1720-57-0x0000000000450000-0x0000000000479000-memory.dll,#1
3⤵
- Suspicious use of WriteProcessMemory
PID:1304

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1720-57-0x0000000000450000-0x0000000000479000-memory.dll,#1
4⤵
- Suspicious use of WriteProcessMemory
PID:1256

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1720-57-0x0000000000450000-0x0000000000479000-memory.dll,#1
5⤵
- Suspicious use of WriteProcessMemory
PID:4852

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1720-57-0x0000000000450000-0x0000000000479000-memory.dll,#1
6⤵
PID:1428