2fb12488073074e6437885d8353d21f70f6c49f22449363e16ea5c6617135d36

Analysis

max time kernel
182s
max time network
194s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 07:17

Target

2fb12488073074e6437885d8353d21f70f6c49f22449363e16ea5c6617135d36.dll
Size

1.9MB
MD5

715de9e525caefe200c452a9eacf974a
SHA1

5b79498936365916744d3d2fe6999c291cb6cec8
SHA256

2fb12488073074e6437885d8353d21f70f6c49f22449363e16ea5c6617135d36
SHA512

b7dc7fc10741817c237d4c94ad95015ea3de2a7ea32f9709cc2c22bd019aa6985b134974bbec252f19100b1237f5a3dc92192c117e3097389e14f01a5847c303
SSDEEP

49152:riqhv3zz9zw1+SZV7NOcaFRa498qEz3zg:riqVP61xNDa/XEz3zg

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1400 wrote to memory of 1340	1400	rundll32.exe	rundll32.exe
PID 1400 wrote to memory of 1340	1400	rundll32.exe	rundll32.exe
PID 1400 wrote to memory of 1340	1400	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2fb12488073074e6437885d8353d21f70f6c49f22449363e16ea5c6617135d36.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1400

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2fb12488073074e6437885d8353d21f70f6c49f22449363e16ea5c6617135d36.dll,#1
2⤵
PID:1340

memory/1340-132-0x0000000000000000-mapping.dmp

Download
memory/1340-133-0x0000000002760000-0x0000000002944000-memory.dmp

Filesize
1.9MB

Download
memory/1340-135-0x0000000002F40000-0x0000000003084000-memory.dmp

Filesize
1.3MB

Download
memory/1340-134-0x0000000002C70000-0x0000000002DE1000-memory.dmp

Filesize
1.4MB

Download
memory/1340-136-0x0000000003090000-0x0000000003163000-memory.dmp

Filesize
844KB

Download
memory/1340-137-0x0000000003170000-0x0000000003231000-memory.dmp

Filesize
772KB

Download
memory/1340-138-0x0000000003170000-0x0000000003231000-memory.dmp

Filesize
772KB

Download
memory/1340-140-0x0000000002F40000-0x0000000003084000-memory.dmp

Filesize
1.3MB

Download