8a53f6df7e3ec08fd1f0b81293009da1c99e08e6e40c89a19e163643ced55e81

Analysis

max time kernel
91s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
06-11-2022 12:04

Target

8a53f6df7e3ec08fd1f0b81293009da1c99e08e6e40c89a19e163643ced55e81.dll
Size

240KB
MD5

0c14bd93984a491355bc81466268eba4
SHA1

e2db1be1a3ccd74850d7860e038563fcae83aef7
SHA256

8a53f6df7e3ec08fd1f0b81293009da1c99e08e6e40c89a19e163643ced55e81
SHA512

fa62608f0b1212d354a46d19b96f156e474945140caebc7991bc660b2cdef2171b29960c0c6c6f825286ca6199173e6b1f2e2ebcace98aa0ef683abe40b2437b
SSDEEP

6144:KVgeeNMPaZRupn+aZGVXpEqI2JX6gAy/Aw6:KEEc8B+XLEqIeX6gAy/q

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4964 wrote to memory of 4540	4964	rundll32.exe	82
PID 4964 wrote to memory of 4540	4964	rundll32.exe	82
PID 4964 wrote to memory of 4540	4964	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8a53f6df7e3ec08fd1f0b81293009da1c99e08e6e40c89a19e163643ced55e81.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4964
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8a53f6df7e3ec08fd1f0b81293009da1c99e08e6e40c89a19e163643ced55e81.dll,#1
  2⤵
  PID:4540

memory/4540-135-0x0000000000000000-mapping.dmp

Download
memory/4540-136-0x0000000010000000-0x000000001003C000-memory.dmp

Filesize
240KB

Download