04c527ce74e2436875e5574779c9d0d44a5f84a137ab02a5d0f728b1cc9d5d45

Analysis

max time kernel
90s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2022, 17:09

Target

04c527ce74e2436875e5574779c9d0d44a5f84a137ab02a5d0f728b1cc9d5d45.dll
Size

198KB
MD5

09aec624237d90db06bbff6e3aaadae2
SHA1

36ad0a2aa24481f762079ee9ff5e48d3a4ca191a
SHA256

04c527ce74e2436875e5574779c9d0d44a5f84a137ab02a5d0f728b1cc9d5d45
SHA512

82941deba67bf638580f09b42f527205476e6f136a2d6ffd0be722117f85e8ad75ca90bad8a4fc93b14f5bb1054f9cfe36753e580b1e568852715d459acd50b8
SSDEEP

3072:HaNkaoJcf4hQedVgybMFRxHmZIN7xWGQEnRXwJ3b/gkEOIhoBI:6exhzFbMkaN7rVRq7gE2o+

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4972 wrote to memory of 1388	4972	rundll32.exe	80
PID 4972 wrote to memory of 1388	4972	rundll32.exe	80
PID 4972 wrote to memory of 1388	4972	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\04c527ce74e2436875e5574779c9d0d44a5f84a137ab02a5d0f728b1cc9d5d45.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\04c527ce74e2436875e5574779c9d0d44a5f84a137ab02a5d0f728b1cc9d5d45.dll,#1
  2⤵
  PID:1388

memory/1388-133-0x0000000010000000-0x0000000010035000-memory.dmp

Filesize
212KB

Download