9122c921c45e24eeb483b115ce341e14a615127eb3230b5424666784563df296

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 13:40

Target

9122c921c45e24eeb483b115ce341e14a615127eb3230b5424666784563df296.dll
Size

115KB
MD5

28e5481f4e3762cc93ccb2b0a94089df
SHA1

dbf2dec97e33c1b9192552dc7ab5574c6818e5b4
SHA256

9122c921c45e24eeb483b115ce341e14a615127eb3230b5424666784563df296
SHA512

e65a2fdf1d4d33adc5f2b168315a80783f658871f9991626609ed0a56642bcca2fca45ed99deaf860910db91ab1e42bcb05d40eb9799bf6dc369bdb5d5db24d5
SSDEEP

3072:azQB90YFFffPQzoul0TuYlGs69yNEB2lIq:WQQYn34EuMuYlGsIyNE

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 5116 wrote to memory of 1268	5116	rundll32.exe	rundll32.exe
PID 5116 wrote to memory of 1268	5116	rundll32.exe	rundll32.exe
PID 5116 wrote to memory of 1268	5116	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9122c921c45e24eeb483b115ce341e14a615127eb3230b5424666784563df296.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5116

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9122c921c45e24eeb483b115ce341e14a615127eb3230b5424666784563df296.dll,#1
2⤵
PID:1268

memory/1268-132-0x0000000000000000-mapping.dmp

Download
memory/1268-133-0x00000000009F0000-0x0000000000A00000-memory.dmp

Filesize
64KB

Download
memory/1268-134-0x0000000000D30000-0x0000000000D50000-memory.dmp

Filesize
128KB

Download
memory/1268-138-0x00000000009F0000-0x0000000000A00000-memory.dmp

Filesize
64KB

Download