2c525b569ce8f3d762fecf38321aa4a06ef985368e6c84748eb5fa597be78abe

Analysis

max time kernel
142s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 14:41

Target

2c525b569ce8f3d762fecf38321aa4a06ef985368e6c84748eb5fa597be78abe.dll
Size

69KB
MD5

1d285bd620cf7fa4a87205c57ccacda4
SHA1

a7842d2c5dfb3be9b7dd79074d36b543f249b484
SHA256

2c525b569ce8f3d762fecf38321aa4a06ef985368e6c84748eb5fa597be78abe
SHA512

857a6a2fd82db7e729637c3d358e714bda59a76a4b8d479705e3f13afb28fa3a333b92988e1d13a51c82d84d0fc18e5399a0c73f6c49d62d36493905814da4b1
SSDEEP

1536:N5LETaT+5OrFSHdc4gzSWllcCCWOYbYf1wweTqCMbe:N5LETa/FoLgK9T1wweTqCYe

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4884 wrote to memory of 364	4884	rundll32.exe	rundll32.exe
PID 4884 wrote to memory of 364	4884	rundll32.exe	rundll32.exe
PID 4884 wrote to memory of 364	4884	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c525b569ce8f3d762fecf38321aa4a06ef985368e6c84748eb5fa597be78abe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4884

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c525b569ce8f3d762fecf38321aa4a06ef985368e6c84748eb5fa597be78abe.dll,#1
2⤵
PID:364

memory/364-132-0x0000000000000000-mapping.dmp

Download
memory/364-133-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/364-134-0x0000000000CB0000-0x0000000000CC5000-memory.dmp

Filesize
84KB

Download
memory/364-135-0x0000000000CB0000-0x0000000000CC5000-memory.dmp

Filesize
84KB

Download