c66e94fd1356fa31ae433a280790ae372f9532b1513ba8482be69f5d6c72e32a

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2022, 10:25

Target

c66e94fd1356fa31ae433a280790ae372f9532b1513ba8482be69f5d6c72e32a.dll
Size

792KB
MD5

307dbf93e103128fea59e1a881919d3a
SHA1

bde6ad04f67ec5a509bd388b8cd7fcc21eff0f96
SHA256

c66e94fd1356fa31ae433a280790ae372f9532b1513ba8482be69f5d6c72e32a
SHA512

58136d4342764dd703e3820ff764a294b7f57e64612e52102c08d1a8476247cb259830f501aaf72b0cb01a8783d928bccfecfd4bd5c7a152a4114e2dfce1e1f7
SSDEEP

24576:+vnImr1gCVYxHnt0NvMveLYHgKn4J9VZrvsyNWAHeKlUUMIn:cnImr17YxHnt0NvMveL869VZr1NWAz

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3588 wrote to memory of 992	3588	rundll32.exe	84
PID 3588 wrote to memory of 992	3588	rundll32.exe	84
PID 3588 wrote to memory of 992	3588	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c66e94fd1356fa31ae433a280790ae372f9532b1513ba8482be69f5d6c72e32a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3588
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c66e94fd1356fa31ae433a280790ae372f9532b1513ba8482be69f5d6c72e32a.dll,#1
  2⤵
  PID:992

memory/992-133-0x0000000040100000-0x00000000401C7000-memory.dmp

Filesize
796KB

Download