ee6a32a87492a4b6ea2fc419f64864c9e3d0adf51565b00e22e98352511986d2

Analysis

max time kernel
93s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-10-2022 21:47

Target

ee6a32a87492a4b6ea2fc419f64864c9e3d0adf51565b00e22e98352511986d2.dll
Size

77KB
MD5

83a1dc8cc2a3e760a6c56324f6312363
SHA1

6ec1a9ed69ceba98fb95e4aadd6b3c30833b3520
SHA256

ee6a32a87492a4b6ea2fc419f64864c9e3d0adf51565b00e22e98352511986d2
SHA512

29b0d67d4e9bfab9d54f88d6c9ceda960c1f819b56e9b009e56dc8fdde1cb16d07790df1469ecfdc99bdda0370bd5d5ef9c4e366d11700b7903e74408b934f54
SSDEEP

1536:uwvVVcAsAh9lQLY1HIv2zQxiwl+SE49/xrGdbHc93GpmR:bVxsA8Ie2I+SHzryyWG

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1372 wrote to memory of 628	1372	rundll32.exe	83
PID 1372 wrote to memory of 628	1372	rundll32.exe	83
PID 1372 wrote to memory of 628	1372	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ee6a32a87492a4b6ea2fc419f64864c9e3d0adf51565b00e22e98352511986d2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ee6a32a87492a4b6ea2fc419f64864c9e3d0adf51565b00e22e98352511986d2.dll,#1
  2⤵
  PID:628

memory/628-132-0x0000000000000000-mapping.dmp

Download
memory/628-133-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download