8a67efc15ba3568fc236365c26a42844d0afd786f5bdb7722f53269e9dd60794

Analysis

max time kernel
3s
max time network
64s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 07:27

Target

8a67efc15ba3568fc236365c26a42844d0afd786f5bdb7722f53269e9dd60794.dll
Size

90KB
MD5

e628d2dabf42a9403e9a8679d61b5470
SHA1

c97d6a40a1a58f53b2e60381065a5b06785cc62a
SHA256

8a67efc15ba3568fc236365c26a42844d0afd786f5bdb7722f53269e9dd60794
SHA512

7319021aa2256edfa04870dcb3fc281420bbcc8b0f517c625b524bb35389192059841f8ff18a69b9ec3ba198fe860173aac5c08a03443ad6867336c32bd15ef8
SSDEEP

1536:+H6ZLXYFoQZjz9x/TkdYFlwYlEZeAHE9NrNcXxZwWtPhKXL22i6hKmXoT9hrCz5:9LoF9Zhx/Tk6vwYEZepchSYhe22i6hld

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

1892 rundll32.exe
1892 rundll32.exe

pid	process
1892	rundll32.exe
1892	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1892 wrote to memory of 2476	1892	rundll32.exe	sihost.exe
PID 1892 wrote to memory of 2496	1892	rundll32.exe	svchost.exe
PID 1892 wrote to memory of 2616	1892	rundll32.exe	taskhostw.exe
PID 1892 wrote to memory of 2764	1892	rundll32.exe	Explorer.EXE
PID 1892 wrote to memory of 520	1892	rundll32.exe	svchost.exe
PID 1892 wrote to memory of 3264	1892	rundll32.exe	DllHost.exe

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2496

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2616

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:520

memory/1892-133-0x00000125EA730000-0x00000125EA746000-memory.dmp

Filesize
88KB

Download
memory/2476-132-0x0000026701D40000-0x0000026701D55000-memory.dmp

Filesize
84KB

Download
memory/2476-138-0x00000267045A0000-0x00000267045B5000-memory.dmp

Filesize
84KB

Download