55fa55b2ab925aa47aceb40802912540a46ee1648673c98e18c6892e3f61c7c9

Analysis

max time kernel
111s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 13:03

Target

55fa55b2ab925aa47aceb40802912540a46ee1648673c98e18c6892e3f61c7c9.dll
Size

396KB
MD5

0cc61259b02624dadba4ce493399a76e
SHA1

35449c65b38b4303ec0502b1ba9cdd175b87f277
SHA256

55fa55b2ab925aa47aceb40802912540a46ee1648673c98e18c6892e3f61c7c9
SHA512

c73b850e679a4d387c59484c6e300075b897bff3939ea98bcc74da826b76f33e718e4c1df593af2714addc9a3e7cfa7f19cab201cfb7f6dc8b8800c5dd5d7ccb
SSDEEP

6144:KiMkQQbHJnjRx77SdWKNrZUqqDL6rGHrIrEewUdoIfK8l1hiVlgAEkO9:KJkQQb1SdWKN1xqn6rIv6K8FmlrO9

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 3140	1812	rundll32.exe	80
PID 1812 wrote to memory of 3140	1812	rundll32.exe	80
PID 1812 wrote to memory of 3140	1812	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\55fa55b2ab925aa47aceb40802912540a46ee1648673c98e18c6892e3f61c7c9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\55fa55b2ab925aa47aceb40802912540a46ee1648673c98e18c6892e3f61c7c9.dll,#1
  2⤵
  PID:3140

memory/3140-133-0x0000000060450000-0x00000000604B3000-memory.dmp

Filesize
396KB

Download