fa822a87da53621093a4ddf0475df739eb6e4eea8d7b7be094417f2abd005d87

Analysis

max time kernel
168s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23/11/2022, 21:45

Target

fa822a87da53621093a4ddf0475df739eb6e4eea8d7b7be094417f2abd005d87.dll
Size

18KB
MD5

54da169a9a0e8bdedfb3d079d4a515ea
SHA1

9911680e29bb643bc623618908343b1dfbe94b44
SHA256

fa822a87da53621093a4ddf0475df739eb6e4eea8d7b7be094417f2abd005d87
SHA512

b085fb73c0b606351a142fe2c2eb69986092062f5b355eaa678a3cbf6f5531f62abffe49ee2237fc0a87248f230b63e9529482364360f4b53a4040d65916ab33
SSDEEP

384:BdA+C3cvZqiafPR/jHVeeLfgPqc+urDZRQcNtg9m:BC+C3oYXf5/zV7kCBuffe

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2568 wrote to memory of 2124	2568	rundll32.exe	82
PID 2568 wrote to memory of 2124	2568	rundll32.exe	82
PID 2568 wrote to memory of 2124	2568	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fa822a87da53621093a4ddf0475df739eb6e4eea8d7b7be094417f2abd005d87.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fa822a87da53621093a4ddf0475df739eb6e4eea8d7b7be094417f2abd005d87.dll,#1
  2⤵
  PID:2124

memory/2124-133-0x0000000077BA0000-0x0000000077BA7000-memory.dmp

Filesize
28KB

Download
memory/2124-134-0x0000000002A20000-0x0000000002A60000-memory.dmp

Filesize
256KB

Download