a85dfec23bf6c6d25b9fab5e6142056880b89589d8e1d3f3d7acf0f32f44ae22

Analysis

max time kernel
113s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 13:27

Target

a85dfec23bf6c6d25b9fab5e6142056880b89589d8e1d3f3d7acf0f32f44ae22.dll
Size

55KB
MD5

9cac74fb91917aa27a17c7a2e8c9fcf0
SHA1

2de3d4433cf86f8a13c9e013e36f9773379cd4f2
SHA256

a85dfec23bf6c6d25b9fab5e6142056880b89589d8e1d3f3d7acf0f32f44ae22
SHA512

ad9d741af7cd582223320f84242cb7285c9cc522d71619cf61cd08dfcdce080b5bdd9818911fed281f378c1040f5169c6e6d5dd340d4cb4ef96bf48d90318fa0
SSDEEP

768:zaUeOCYq8/KfC5efalsxKEpqKYF/hu+8D3klhv+92veLRmR6:+uCN4Ka5efaSxKEwKAJud0b+9LRn

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4364 wrote to memory of 2776	4364	rundll32.exe	rundll32.exe
PID 4364 wrote to memory of 2776	4364	rundll32.exe	rundll32.exe
PID 4364 wrote to memory of 2776	4364	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a85dfec23bf6c6d25b9fab5e6142056880b89589d8e1d3f3d7acf0f32f44ae22.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4364

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a85dfec23bf6c6d25b9fab5e6142056880b89589d8e1d3f3d7acf0f32f44ae22.dll,#1
2⤵
PID:2776

memory/2776-132-0x0000000000000000-mapping.dmp

Download
memory/2776-134-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2776-133-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2776-135-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2776-136-0x0000000000A20000-0x0000000000A34000-memory.dmp

Filesize
80KB

Download
memory/2776-137-0x0000000000A20000-0x0000000000A34000-memory.dmp

Filesize
80KB

Download