8a3be3a2745aff80ef88049a8cfc758ed05d54d62b236236aad0cee11bfc35fc

Analysis

max time kernel
314s
max time network
335s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 11:25

Target

f731b25c32963507d307255237d4c52095c5714ef15cdcf6f923bb47d717e95f.dll
Size

505KB
MD5

9af6a92f064dfdd90dc0956be84f6df5
SHA1

9a0283c74a50b0c7d2107e1a89570e410a9b9ed6
SHA256

8a3be3a2745aff80ef88049a8cfc758ed05d54d62b236236aad0cee11bfc35fc
SHA512

0b1b1b9f08c773c503e3b4a2df523b55cf9634fdcd054de1262aece00490045bce66188864132e5c6730bca3adc6e527d3c3c23c5939b8edcb2cb8e3a1a5ca0e
SSDEEP

6144:RXX8qk+7206ViSn9hagxr1nIJ03ggHdhs9xCeeOM:R8qVi+saa6J+ggHbsbeOM

Score

8^/10

Blocklisted process makes network request 6 IoCs

Processes:

rundll32.exe

flow pid process

37 2860 rundll32.exe
44 2860 rundll32.exe
52 2860 rundll32.exe
54 2860 rundll32.exe
62 2860 rundll32.exe
65 2860 rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3908 wrote to memory of 2860	3908	rundll32.exe	rundll32.exe
PID 3908 wrote to memory of 2860	3908	rundll32.exe	rundll32.exe
PID 3908 wrote to memory of 2860	3908	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f731b25c32963507d307255237d4c52095c5714ef15cdcf6f923bb47d717e95f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3908

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f731b25c32963507d307255237d4c52095c5714ef15cdcf6f923bb47d717e95f.dll,#1
2⤵
- Blocklisted process makes network request
PID:2860

memory/2860-132-0x0000000000000000-mapping.dmp

Download
memory/2860-133-0x0000000000D30000-0x0000000000D37000-memory.dmp

Filesize
28KB

Download