244c2623ff1cf22a565c3a6291b6280cfcdd221672c9e260c677543bebb6e78a

Analysis

max time kernel
94s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/10/2022, 17:35

Target

244c2623ff1cf22a565c3a6291b6280cfcdd221672c9e260c677543bebb6e78a.dll
Size

444KB
MD5

516a7d09524e9695d7bca9a2671b9cd0
SHA1

8145a98d3bb52d68f39531e925fc7700a0733e38
SHA256

244c2623ff1cf22a565c3a6291b6280cfcdd221672c9e260c677543bebb6e78a
SHA512

2f224be1cebf5b46c43148c7a06b8b425a25589857ccde564e2ceed994164a4d6663bb476f041e81bd2c3dfbf42092fb549581c9d666b442b33ffa5f1298ea0d
SSDEEP

12288:2198cOAo3eCZlw3DLnoEPfqGAtyiPml8ff:2T8MoOCZlw3DLnTfqGuPqm

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4208 wrote to memory of 628	4208	rundll32.exe	81
PID 4208 wrote to memory of 628	4208	rundll32.exe	81
PID 4208 wrote to memory of 628	4208	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\244c2623ff1cf22a565c3a6291b6280cfcdd221672c9e260c677543bebb6e78a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4208
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\244c2623ff1cf22a565c3a6291b6280cfcdd221672c9e260c677543bebb6e78a.dll,#1
  2⤵
  PID:628

memory/628-134-0x0000000067630000-0x000000006769F000-memory.dmp

Filesize
444KB

Download