3b02b8999549944f68e8d3624f5a4f15c9d2c9aa7d15a0f8419fb40ab8725405

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 21:20

Target

3b02b8999549944f68e8d3624f5a4f15c9d2c9aa7d15a0f8419fb40ab8725405.dll
Size

117KB
MD5

0fdfe72e2bb2cffa49ab4729dba595e0
SHA1

a82a65efa6d2eaef240aa43e9e5ed64824d9efa0
SHA256

3b02b8999549944f68e8d3624f5a4f15c9d2c9aa7d15a0f8419fb40ab8725405
SHA512

82eea08761f417bf8706096f4c4611df8ff7497765ebc59ff073f7c07d59b65d8dade9a44223b0e38b0d9eb3ed7bcf90a04257789c23b19856911041b224aead
SSDEEP

3072:j+6TCy3sEUnafop/zvW/8AcCIbOwYGx3zq58OfsHNX0ob1M:S6TCy3sEUaQp/rblbOwvjuaES1M

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 4324	1476	rundll32.exe	79
PID 1476 wrote to memory of 4324	1476	rundll32.exe	79
PID 1476 wrote to memory of 4324	1476	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b02b8999549944f68e8d3624f5a4f15c9d2c9aa7d15a0f8419fb40ab8725405.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b02b8999549944f68e8d3624f5a4f15c9d2c9aa7d15a0f8419fb40ab8725405.dll,#1
  2⤵
  PID:4324

memory/4324-133-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download