4f27eb2a8ec9a6ab31835839599ef059d7e55394e79c109165548acfa4f996c0

Analysis

max time kernel
264s
max time network
302s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 14:21

Target

4f27eb2a8ec9a6ab31835839599ef059d7e55394e79c109165548acfa4f996c0.dll
Size

112KB
MD5

a591c41fa2b1132c08164144966800d8
SHA1

0ecb6448a7022e7c36c42dcd3b96f3a2c88f0cbc
SHA256

4f27eb2a8ec9a6ab31835839599ef059d7e55394e79c109165548acfa4f996c0
SHA512

6cf44aa4d0a8cce545317cf6deb0519b2d002f06d63d7521d8c8bb46624e366767f137f9b9e1e69fbd2a4b2068c9865c33c2f95444267832f5456bbc8d72ca91
SSDEEP

3072:mlOFQBLYSK/SsXb2J/EovqXAAXvKTTa1U6n:mA2JstXAuvK2

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3424 wrote to memory of 1408	3424	rundll32.exe	rundll32.exe
PID 3424 wrote to memory of 1408	3424	rundll32.exe	rundll32.exe
PID 3424 wrote to memory of 1408	3424	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4f27eb2a8ec9a6ab31835839599ef059d7e55394e79c109165548acfa4f996c0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3424

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4f27eb2a8ec9a6ab31835839599ef059d7e55394e79c109165548acfa4f996c0.dll,#1
2⤵
PID:1408

memory/1408-132-0x0000000000000000-mapping.dmp

Download
memory/1408-133-0x00000000005E0000-0x00000000005EF000-memory.dmp

Filesize
60KB

Download
memory/1408-134-0x00000000009A0000-0x00000000009BE000-memory.dmp

Filesize
120KB

Download
memory/1408-138-0x00000000005E0000-0x00000000005EF000-memory.dmp

Filesize
60KB

Download