3bd9ca98a1da6c04d70dff889cef5431da13904aafe926286e94216004e8c8b5

Analysis

max time kernel
151s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30-10-2022 23:16

Target

3bd9ca98a1da6c04d70dff889cef5431da13904aafe926286e94216004e8c8b5.dll
Size

256KB
MD5

907a47141e4d3ac345972f3418ed09b7
SHA1

c9e95eaaaf1aa5a8edd56e2f8eb5ccbc4b76a561
SHA256

3bd9ca98a1da6c04d70dff889cef5431da13904aafe926286e94216004e8c8b5
SHA512

0972d58e302bd3d13444e46f921f1f69127b0f3b1a8c2f0ccff94d89caba062cabf7501a2316a1478576feae75217344ad9f41f6c070cff2186955c82cd5aa1b
SSDEEP

6144:00j4Yey6Atfm9bjeV+v5Qq/gWkEYrLUJwIe/:ley/Ijb/gW6ifM

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4708 wrote to memory of 5044	4708	rundll32.exe	80
PID 4708 wrote to memory of 5044	4708	rundll32.exe	80
PID 4708 wrote to memory of 5044	4708	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3bd9ca98a1da6c04d70dff889cef5431da13904aafe926286e94216004e8c8b5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4708
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3bd9ca98a1da6c04d70dff889cef5431da13904aafe926286e94216004e8c8b5.dll,#1
  2⤵
  PID:5044

memory/5044-133-0x000000006D720000-0x000000006D762000-memory.dmp

Filesize
264KB

Download