d28da203703aa8cf522fce28a267cde030fc02c7f1cfa98eef68c0b9aa4eae67

Analysis

max time kernel
62s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2022, 15:02

Target

d28da203703aa8cf522fce28a267cde030fc02c7f1cfa98eef68c0b9aa4eae67.dll
Size

336KB
MD5

82dd3791391abc092ec2f0f92939cda9
SHA1

1583185e67e69f81421b05825b68f066014cc8bc
SHA256

d28da203703aa8cf522fce28a267cde030fc02c7f1cfa98eef68c0b9aa4eae67
SHA512

1eb872fd58f8b793e7bb1833b0bb279bcb5a86ad1d1d77615c3d7f37100bbe08b220919946d592a83b1a9a4036de61c0ba6157ae30a53c529e47bf749f0fd6b4
SSDEEP

6144:qeBAsUbCN5LWfvqEKvzQUwFr9+ZOr5PIbDtE0G/ocdHlNtrpAKRgMwP337Y/2+Mj:qeBAJbRC76Fd4bcldq7DGvsOEIp

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4416 wrote to memory of 3252	4416	rundll32.exe	84
PID 4416 wrote to memory of 3252	4416	rundll32.exe	84
PID 4416 wrote to memory of 3252	4416	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d28da203703aa8cf522fce28a267cde030fc02c7f1cfa98eef68c0b9aa4eae67.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4416
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d28da203703aa8cf522fce28a267cde030fc02c7f1cfa98eef68c0b9aa4eae67.dll,#1
  2⤵
  PID:3252

memory/3252-133-0x0000000010000000-0x0000000010057000-memory.dmp

Filesize
348KB

Download