381c0c8905db10fdb239d0c06b5a525b6da4d3883dc7d5afd31e0260812b821b

Analysis

max time kernel
61s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 21:21

Target
381c0c8905db10fdb239d0c06b5a525b6da4d3883dc7d5afd31e0260812b821b.dll
Size 144KB
Sample221106-z7p5faccc2
SHA256 381c0c8905db10fdb239d0c06b5a525b6da4d3883dc7d5afd31e0260812b821b
MD5 0904c9d5f692ba7580030a8007454b70
SHA1 c4a9ad7b76ef8ec955a9c4dd118f36186309aa2e
SHA512 438b1e87c5529afe9a494948ed6a46a9273012956f158ff94698de32a162e5989ba65efe3d985b50b3400a37c10c0fe79dfaaa88c52f25c222528baf050150a9
SSDEEP 3072:pXT39tH99ToEADyttL92DNL+TUqzr3P81eFOPNT5WgeC:pD7dGzebPgerUMo1eC
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3736 wrote to memory of 1884	3736	rundll32.exe	82
PID 3736 wrote to memory of 1884	3736	rundll32.exe	82
PID 3736 wrote to memory of 1884	3736	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\381c0c8905db10fdb239d0c06b5a525b6da4d3883dc7d5afd31e0260812b821b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3736
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\381c0c8905db10fdb239d0c06b5a525b6da4d3883dc7d5afd31e0260812b821b.dll,#1
  2⤵
  PID:1884

memory/1884-133-0x0000000010000000-0x0000000010025000-memory.dmp

Download