83a27ef5b8edf9c744b78bab7eab6ed40eea64741fbcf59131e409fc52c0344e

Analysis

max time kernel
138s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 12:57

Target

5ca7ccd312871a20cc5a35e3b115266fe8a9ceb3470844597d73a0ed8013c2b7.dll
Size

489KB
MD5

6e60c8daa198a7b8b141d574189bdea5
SHA1

a35646c19505e7215bcd9337e120b8594c80ae56
SHA256

83a27ef5b8edf9c744b78bab7eab6ed40eea64741fbcf59131e409fc52c0344e
SHA512

5bdd4730dba1f3600b19ecc4d1f8aff098ae2ab10f460d842128390b1021fe9629a903262093b30623a046145e9bb2eaf0f43d5a95f8718adf07dceb0d22ea0f
SSDEEP

6144:Yq8bD/aNTZP26JnCJVYa9aqtlUSigxtgrabTUsajM:l4ap19Ta9tUhst/0pjM

Score

8^/10

Blocklisted process makes network request 6 IoCs

Processes:

rundll32.exe

flow pid process

5 1884 rundll32.exe
25 1884 rundll32.exe
38 1884 rundll32.exe
41 1884 rundll32.exe
44 1884 rundll32.exe
45 1884 rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4572 wrote to memory of 1884	4572	rundll32.exe	rundll32.exe
PID 4572 wrote to memory of 1884	4572	rundll32.exe	rundll32.exe
PID 4572 wrote to memory of 1884	4572	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ca7ccd312871a20cc5a35e3b115266fe8a9ceb3470844597d73a0ed8013c2b7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4572

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ca7ccd312871a20cc5a35e3b115266fe8a9ceb3470844597d73a0ed8013c2b7.dll,#1
2⤵
- Blocklisted process makes network request
PID:1884

memory/1884-132-0x0000000000000000-mapping.dmp

Download
memory/1884-133-0x0000000001070000-0x0000000001077000-memory.dmp

Filesize
28KB

Download