8c8e701bb73712f8d8a62a5bf21b19594e2833c04a2c8af52b34561fafeb6504

Analysis

max time kernel
143s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 20:57

Target

8c8e701bb73712f8d8a62a5bf21b19594e2833c04a2c8af52b34561fafeb6504.dll
Size

116KB
MD5

0c89adaabcafa265ca5f55e51da3c4e0
SHA1

07a391d3162a7d962e3f8981d8b386e960239d9b
SHA256

8c8e701bb73712f8d8a62a5bf21b19594e2833c04a2c8af52b34561fafeb6504
SHA512

70a891032584aff43e18029533065c4168bda1604419cbd6579693c8ec45b516a40fafc051069e0f4c0c536371f071107900ab08e41e6d9b2af662330aeef72c
SSDEEP

1536:zyY8wugEwOVEXdz70e4gIWCnFTRT3TmXObEcskCpSzgxvFW3vsv5brSNJ6w:zyKF70e4gBWFkXObjex9wsBbu0w

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4532 wrote to memory of 2220	4532	rundll32.exe	79
PID 4532 wrote to memory of 2220	4532	rundll32.exe	79
PID 4532 wrote to memory of 2220	4532	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8c8e701bb73712f8d8a62a5bf21b19594e2833c04a2c8af52b34561fafeb6504.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4532
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8c8e701bb73712f8d8a62a5bf21b19594e2833c04a2c8af52b34561fafeb6504.dll,#1
  2⤵
  PID:2220

memory/2220-133-0x0000000075370000-0x0000000075391000-memory.dmp

Filesize
132KB

Download
memory/2220-134-0x0000000075370000-0x0000000075391000-memory.dmp

Filesize
132KB

Download