4dc6f530cf0e3715a60c956928d41d329daf189b3d095fbb9239d243fc6893db

Analysis

max time kernel
90s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
29-10-2022 20:40

Target

4dc6f530cf0e3715a60c956928d41d329daf189b3d095fbb9239d243fc6893db.dll
Size

216KB
MD5

8434ce8f4ffe1403e613a171c861909c
SHA1

bc6151ff4b211ccb58210f24a22673ade8930e39
SHA256

4dc6f530cf0e3715a60c956928d41d329daf189b3d095fbb9239d243fc6893db
SHA512

b90bdbb76d4ce9508797402ee8c349cd779ccc645fc4500886986af945fee788575e14e8bbb7206fa95bbbe8b260df009a892144b420be7da08db90ee5f8008e
SSDEEP

3072:ETL3VCQxJ/VzlkMS9nfcmHs7Qg/cBW3iomZfCK1WWkTRiMqqDa/0tCL:ETLdftTUs7QpkyoyYLT/qqDGl

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3136 wrote to memory of 1572	3136	rundll32.exe	81
PID 3136 wrote to memory of 1572	3136	rundll32.exe	81
PID 3136 wrote to memory of 1572	3136	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4dc6f530cf0e3715a60c956928d41d329daf189b3d095fbb9239d243fc6893db.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3136
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4dc6f530cf0e3715a60c956928d41d329daf189b3d095fbb9239d243fc6893db.dll,#1
  2⤵
  PID:1572

memory/1572-132-0x0000000000000000-mapping.dmp

Download
memory/1572-133-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download