ba95cb69fbb45ae79729f3b1d1004df2161e996fc3a9f82170317593af25d4e2

Analysis

max time kernel
196s
max time network
209s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 11:09

Target

ba95cb69fbb45ae79729f3b1d1004df2161e996fc3a9f82170317593af25d4e2.dll
Size

56KB
MD5

c771a8d25fe2a82c89e0d35f3fde5281
SHA1

a43dacddc7779619b7f26266b0b9c8891d9f7912
SHA256

ba95cb69fbb45ae79729f3b1d1004df2161e996fc3a9f82170317593af25d4e2
SHA512

f553adfe0b3ae401b8c9d76c0e9fe43ecd4ff8f5120d67947c83e20194b3d130c09ce291c28bdea0f3cd9aa6f30cc060f9af0615cc7641cec953f1f593614b06
SSDEEP

768:E0EX3DN2zLkgDupilEUY/BuDSHLcKcqNJU0yJssO+wcSDPnGMEaZX:MKrDu8PiuDaBDU0yZGDvlEeX

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4236 wrote to memory of 1084	4236	rundll32.exe	rundll32.exe
PID 4236 wrote to memory of 1084	4236	rundll32.exe	rundll32.exe
PID 4236 wrote to memory of 1084	4236	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ba95cb69fbb45ae79729f3b1d1004df2161e996fc3a9f82170317593af25d4e2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4236

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ba95cb69fbb45ae79729f3b1d1004df2161e996fc3a9f82170317593af25d4e2.dll,#1
2⤵
PID:1084

memory/1084-132-0x0000000000000000-mapping.dmp

Download
memory/1084-133-0x0000000000B90000-0x0000000000BA2000-memory.dmp

Filesize
72KB

Download
memory/1084-134-0x0000000000BD0000-0x0000000000BE2000-memory.dmp

Filesize
72KB

Download