de69f60adf1981adc1ed47f19216acfacfc13a2bc19807a54f1acd4f6fab4f34

Analysis

max time kernel
112s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2022, 15:02

Target

de69f60adf1981adc1ed47f19216acfacfc13a2bc19807a54f1acd4f6fab4f34.dll
Size

56KB
MD5

03f77591f78d024d19e54437740209ca
SHA1

204458f503c3b8b589bdcf60d71eb3f01518fd1f
SHA256

de69f60adf1981adc1ed47f19216acfacfc13a2bc19807a54f1acd4f6fab4f34
SHA512

d7dd455b49cd7f589cf7a5a39a92cddd1b161f923dafdcbc97fc85bd26ceaab782563bd14278602851e44e7d6da12eb24592cd853e90282aacfdd962de188269
SSDEEP

1536:eBOOXD1kKH4LvUF+Zfb4xSrYCMJ73ln0inC:eBOOX6c+FNkb7Vn04C

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 3224	4884	rundll32.exe	83
PID 4884 wrote to memory of 3224	4884	rundll32.exe	83
PID 4884 wrote to memory of 3224	4884	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\de69f60adf1981adc1ed47f19216acfacfc13a2bc19807a54f1acd4f6fab4f34.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\de69f60adf1981adc1ed47f19216acfacfc13a2bc19807a54f1acd4f6fab4f34.dll,#1
  2⤵
  PID:3224

memory/3224-133-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download