36b398fc8629d2fc1aa8511ea9d5e3f711694d08b0b75014af95c3ab47cf8f8c

Analysis

max time kernel
100s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30-10-2022 23:16

Target

36b398fc8629d2fc1aa8511ea9d5e3f711694d08b0b75014af95c3ab47cf8f8c.dll
Size

248KB
MD5

91dac98be6696f9ea3337277b643a098
SHA1

37d5eed096e22fc4c48628f5bbfb8463b902b8af
SHA256

36b398fc8629d2fc1aa8511ea9d5e3f711694d08b0b75014af95c3ab47cf8f8c
SHA512

9b100bf2eb3251108f0ddcb96cff8c50bb6b1865fee60e0fc6a52dd36b88d114bc2c5f82e13b2de366ca3872b819bf99a08c4eb4844428829b05b5d57db2178b
SSDEEP

6144:ywx1W/aIumH7aTiB6mqhv5LgjaEX7Rs0:ywx1WyIpHeTiB6mqAX7h

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4364 wrote to memory of 3672	4364	rundll32.exe	79
PID 4364 wrote to memory of 3672	4364	rundll32.exe	79
PID 4364 wrote to memory of 3672	4364	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\36b398fc8629d2fc1aa8511ea9d5e3f711694d08b0b75014af95c3ab47cf8f8c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4364
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\36b398fc8629d2fc1aa8511ea9d5e3f711694d08b0b75014af95c3ab47cf8f8c.dll,#1
  2⤵
  PID:3672

memory/3672-133-0x0000000062F30000-0x0000000062F6F000-memory.dmp

Filesize
252KB

Download