427a677bf646825377b84613b1cfadc89228f768659f3adf8e79303df20d64f1

Analysis

max time kernel
91s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
02/11/2022, 14:15

Target

427a677bf646825377b84613b1cfadc89228f768659f3adf8e79303df20d64f1.dll
Size

2.0MB
MD5

24cfc40f9f1173811043daa60028417c
SHA1

701adf450c273330b6d57b4c0cb46822855fa3d8
SHA256

427a677bf646825377b84613b1cfadc89228f768659f3adf8e79303df20d64f1
SHA512

49d2e8aedfad29a9d07bc6c0faf8c2589e4b0d42b0e01dba11721068ccd6eac921d7caeaf2150fa9c58614940d3ea568105668234323a32cd4afc9f5692e06d3
SSDEEP

24576:kt/9Fh821Zotk41+4npC28FJngG1fVEk+oR+vqXVTvM3pUysEhepazFMaipZaNie:kt/fCcb+kgqlLM3aynlfCPydFJr

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5064 wrote to memory of 4956	5064	rundll32.exe	81
PID 5064 wrote to memory of 4956	5064	rundll32.exe	81
PID 5064 wrote to memory of 4956	5064	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\427a677bf646825377b84613b1cfadc89228f768659f3adf8e79303df20d64f1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\427a677bf646825377b84613b1cfadc89228f768659f3adf8e79303df20d64f1.dll,#1
  2⤵
  PID:4956

memory/4956-133-0x0000000003220000-0x0000000003348000-memory.dmp

Filesize
1.2MB

Download
memory/4956-134-0x0000000003480000-0x00000000035A8000-memory.dmp

Filesize
1.2MB

Download
memory/4956-135-0x00000000035B0000-0x0000000003677000-memory.dmp

Filesize
796KB

Download
memory/4956-136-0x0000000003680000-0x0000000003734000-memory.dmp

Filesize
720KB

Download
memory/4956-137-0x0000000003680000-0x0000000003734000-memory.dmp

Filesize
720KB

Download
memory/4956-139-0x0000000003480000-0x00000000035A8000-memory.dmp

Filesize
1.2MB

Download