dffc6c1e0acfd522ae0813b26d6940443eca3ef0736ad3b8bc296cd923ccfbf1

Analysis

max time kernel
133s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/11/2022, 21:20

Target

dffc6c1e0acfd522ae0813b26d6940443eca3ef0736ad3b8bc296cd923ccfbf1.dll
Size

3.3MB
MD5

204389137b89f5274b702266ba59afc5
SHA1

8c8451cf3ae8e851cb3b4623273d3911c0bf832c
SHA256

dffc6c1e0acfd522ae0813b26d6940443eca3ef0736ad3b8bc296cd923ccfbf1
SHA512

bad9a8b6c8c302793d97cb11aadbda391295d41df90a5776cc46fb58a37766370bce1507d6766705470589007f76cf87fda4fe17abf101550d1b26a9de2f2272
SSDEEP

98304:RU/1k250ocT5SMO6uXlvkYL//JAjOmkfDnaGikEgTzUG:RGk25vcK5ZbL/BmkbaKzUG

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 2996	2672	rundll32.exe	79
PID 2672 wrote to memory of 2996	2672	rundll32.exe	79
PID 2672 wrote to memory of 2996	2672	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dffc6c1e0acfd522ae0813b26d6940443eca3ef0736ad3b8bc296cd923ccfbf1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dffc6c1e0acfd522ae0813b26d6940443eca3ef0736ad3b8bc296cd923ccfbf1.dll,#1
  2⤵
  PID:2996

memory/2996-133-0x0000000002100000-0x0000000002F6E000-memory.dmp

Filesize
14.4MB

Download
memory/2996-134-0x0000000002100000-0x0000000002F6E000-memory.dmp

Filesize
14.4MB

Download
memory/2996-135-0x0000000002100000-0x0000000002241000-memory.dmp

Filesize
1.3MB

Download