53d669a076616723136d93d74ab3605a39de870238d0cada50d3a7d2eb955435

Analysis

max time kernel
168s
max time network
205s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 11:06

Target

53d669a076616723136d93d74ab3605a39de870238d0cada50d3a7d2eb955435.dll
Size

639KB
MD5

d4821ef66a71768ffbcf390cbabcdca0
SHA1

653b0c0c244846a961c6034d02cd97c3fec6458b
SHA256

53d669a076616723136d93d74ab3605a39de870238d0cada50d3a7d2eb955435
SHA512

a8ca5f479c77c6da48a13e71eed8a698368a2da8c12cab8aa8de50a5f24dc0467f5a97aab21f07c1dfbb2548a78bf9c27f9672ab8052fbb33c92ce9cd872132e
SSDEEP

12288:PfVHLSX/d9bIxpyWmfA33EVdawVrdylKNdWGG44yw5WVZaHIrhAlEfx:dwdKyWmfA3UVoaJylKNaHuh

Score

8^/10

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

13 588 rundll32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

588 rundll32.exe
588 rundll32.exe

flow	pid	process
13	588	rundll32.exe

pid	process
588	rundll32.exe
588	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3296 wrote to memory of 588	3296	rundll32.exe	rundll32.exe
PID 3296 wrote to memory of 588	3296	rundll32.exe	rundll32.exe
PID 3296 wrote to memory of 588	3296	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\53d669a076616723136d93d74ab3605a39de870238d0cada50d3a7d2eb955435.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3296

memory/588-132-0x0000000000000000-mapping.dmp

Download
memory/588-133-0x0000000000750000-0x0000000000765000-memory.dmp

Filesize
84KB

Download
memory/588-134-0x0000000002130000-0x0000000002271000-memory.dmp

Filesize
1.3MB

Download