eb73993774bba6ab6cb14e9045dfa451fd379d7a9e62d85cac1618b9f2d03dd7

Analysis

max time kernel
91s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
28/10/2022, 20:03

Target

eb73993774bba6ab6cb14e9045dfa451fd379d7a9e62d85cac1618b9f2d03dd7.dll
Size

404KB
MD5

0c4f6782ace747a39239568fac0fa1c0
SHA1

26b9548a1ae26cc71cd75a3bf099e05e96e077a1
SHA256

eb73993774bba6ab6cb14e9045dfa451fd379d7a9e62d85cac1618b9f2d03dd7
SHA512

d90bd98685f861a360811ce744cab1d031b2380c8d72f11fd66ee13d18d9d1da4e50a350fd7c7052bf1e612c9402428b780bea8a270094806753a3878be3d5eb
SSDEEP

3072:ZRyIqI7Zz2HkKbbve1fAlVTholfPSuQoh5i2jzfXvJUdIqmHO24hw/J6sFZT5Sl:eIqoR2EybYfc2jLXvY0Oxwh65l

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 4752	2116	rundll32.exe	47
PID 2116 wrote to memory of 4752	2116	rundll32.exe	47
PID 2116 wrote to memory of 4752	2116	rundll32.exe	47

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\eb73993774bba6ab6cb14e9045dfa451fd379d7a9e62d85cac1618b9f2d03dd7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\eb73993774bba6ab6cb14e9045dfa451fd379d7a9e62d85cac1618b9f2d03dd7.dll,#1
  2⤵
  PID:4752

memory/4752-133-0x0000000010000000-0x000000001007B000-memory.dmp

Filesize
492KB

Download