f6139c18bc80998491c09a89642b273b80fa4c0368a07c6ef13b8c36e5cdf688

Analysis

max time kernel
217s
max time network
311s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 10:47

Target

f6139c18bc80998491c09a89642b273b80fa4c0368a07c6ef13b8c36e5cdf688.dll
Size

84KB
MD5

935bf2c72ea6e3aeccac01d91da1845c
SHA1

578daedabdc471d4e1832987a2c6f0ac625ec415
SHA256

f6139c18bc80998491c09a89642b273b80fa4c0368a07c6ef13b8c36e5cdf688
SHA512

be5f07c8b332405ebcaa4795a31af25f963e6762241dad0bbf1e1e3803d2c5051d5946f4314dd45164e86309002e2d1ab64e1665b30edd03192ea8afbaae4b10
SSDEEP

1536:WMLgGGjJIFEEDxt0L1t0JA//EEWfKcw84RTJIPHfHi1zUd62:WMLgGGj9EDx+L1t0eHXWfKzrmX6Qd6

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3480 wrote to memory of 372	3480	rundll32.exe	rundll32.exe
PID 3480 wrote to memory of 372	3480	rundll32.exe	rundll32.exe
PID 3480 wrote to memory of 372	3480	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f6139c18bc80998491c09a89642b273b80fa4c0368a07c6ef13b8c36e5cdf688.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3480

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f6139c18bc80998491c09a89642b273b80fa4c0368a07c6ef13b8c36e5cdf688.dll,#1
2⤵
PID:372

memory/372-132-0x0000000000000000-mapping.dmp

Download
memory/372-133-0x0000000001150000-0x000000000115D000-memory.dmp

Filesize
52KB

Download
memory/372-135-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download
memory/372-138-0x0000000001150000-0x000000000115D000-memory.dmp

Filesize
52KB

Download
memory/372-139-0x0000000001150000-0x000000000115D000-memory.dmp

Filesize
52KB

Download