dc9bd01d841d95c37ed2cb766aa8644ed11906e294ad85f56037de37862ead2e

Analysis

max time kernel
204s
max time network
223s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 12:18

Target

dc9bd01d841d95c37ed2cb766aa8644ed11906e294ad85f56037de37862ead2e.dll
Size

69KB
MD5

0745c9f1b27287a5773b87d045450b83
SHA1

49e33e4cb984f239725d693981b7d5ac64e1468d
SHA256

dc9bd01d841d95c37ed2cb766aa8644ed11906e294ad85f56037de37862ead2e
SHA512

af62766934f456734d94862d0e2e7c0c8aa14818a36605864573d0f0c44b069dee2a80539c6f5cfa0637dd195f27967de589a8b1c5cd958637cdaf8b188e39ae
SSDEEP

1536:1LLKh7Wt5esFOu0+EBT0lk77y7caeyZN7:xLJdOu0+flknDaBZ9

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 4396	2240	rundll32.exe	79
PID 2240 wrote to memory of 4396	2240	rundll32.exe	79
PID 2240 wrote to memory of 4396	2240	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dc9bd01d841d95c37ed2cb766aa8644ed11906e294ad85f56037de37862ead2e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dc9bd01d841d95c37ed2cb766aa8644ed11906e294ad85f56037de37862ead2e.dll,#1
  2⤵
  PID:4396

memory/4396-133-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download