9b8a0d9ae7f4baa0ef2d959772dca556813591f1d10557e8483e1df7c778b5f8

Analysis

max time kernel
144s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2022, 23:08

Target

9b8a0d9ae7f4baa0ef2d959772dca556813591f1d10557e8483e1df7c778b5f8.dll
Size

220KB
MD5

a0e416126870a8d212f35fdd738ad27a
SHA1

59865a8bad5b457bd66548221890c1035efa91cd
SHA256

9b8a0d9ae7f4baa0ef2d959772dca556813591f1d10557e8483e1df7c778b5f8
SHA512

12415fe90a20cf7e17424783c25bf139dd7da5767f8f6b4502d410a59d4c407c55eccd87323666452c9107e91717bc27349799d1aff54ee54e707b3b3c20f677
SSDEEP

3072:QbqyspRbT9XcmglwwpmZ26v0uq4teaSRLn7bqb2WjIyrnC4+Rip4gP7RI2rYm/Vz:VyKT9XElwwc26v0ufAx7GF864MI2/x7

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4712 wrote to memory of 4940	4712	rundll32.exe	72
PID 4712 wrote to memory of 4940	4712	rundll32.exe	72
PID 4712 wrote to memory of 4940	4712	rundll32.exe	72

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9b8a0d9ae7f4baa0ef2d959772dca556813591f1d10557e8483e1df7c778b5f8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9b8a0d9ae7f4baa0ef2d959772dca556813591f1d10557e8483e1df7c778b5f8.dll,#1
  2⤵
  PID:4940

memory/4940-133-0x0000000010000000-0x0000000010037000-memory.dmp

Filesize
220KB

Download