a94e340528913f667f37df1d897f0772178f1605453a5dde781f4deefc7d8847

Analysis

max time kernel
173s
max time network
184s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 13:27

Target

a94e340528913f667f37df1d897f0772178f1605453a5dde781f4deefc7d8847.dll
Size

70KB
MD5

585d7dc3e0aa1b84947d35453f51f51e
SHA1

45ff2d3951c9029f906716f5da934e9b95412cf1
SHA256

a94e340528913f667f37df1d897f0772178f1605453a5dde781f4deefc7d8847
SHA512

9f44e7c06b8af00990c6f60fecbfd5d489c712150416ed30dad16ab3f7d7d8f8a53f092a20a0ba776b1758b4b0394dfbcc33ce80a6d3d5440f8065bf6a8ab249
SSDEEP

1536:0WlGE7UGIQM3wlqPAv9iZL7f5FK7bRFo4vIvBHqqn6:JlGE7U1QUwcPAvGFFMo4qBHqm6

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1396 wrote to memory of 2604	1396	rundll32.exe	rundll32.exe
PID 1396 wrote to memory of 2604	1396	rundll32.exe	rundll32.exe
PID 1396 wrote to memory of 2604	1396	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a94e340528913f667f37df1d897f0772178f1605453a5dde781f4deefc7d8847.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1396

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a94e340528913f667f37df1d897f0772178f1605453a5dde781f4deefc7d8847.dll,#1
2⤵
PID:2604

memory/2604-132-0x0000000000000000-mapping.dmp

Download
memory/2604-133-0x0000000000320000-0x0000000000338000-memory.dmp

Filesize
96KB

Download
memory/2604-134-0x00000000003C0000-0x00000000003D8000-memory.dmp

Filesize
96KB

Download
memory/2604-135-0x00000000003C0000-0x00000000003D8000-memory.dmp

Filesize
96KB

Download