48b58de52e1fdb863827e05424440bfe730fb210d35a8baa7239eb3127216b40

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 14:25

Target

48b58de52e1fdb863827e05424440bfe730fb210d35a8baa7239eb3127216b40.dll
Size

144KB
MD5

74a9b736cd5543e46c6e94fed2fd7ab4
SHA1

b74eba12d40294bea95b39122c8a655f9c6f518c
SHA256

48b58de52e1fdb863827e05424440bfe730fb210d35a8baa7239eb3127216b40
SHA512

a5f4ae7d7ef01bea2da79f292a398a4b5f2de89d9e240b5dd3d505ae001a0739e2227b7485d4d46cc586079160a4b6243f24c2709b10f3c691b55ea201d5e967
SSDEEP

3072:KCN845tuG7wVJZDa7taxsg0Nxils60xo4MqqDLy/zed:B8458G7wRDu35NxR602qqDLuc

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4808 wrote to memory of 3692	4808	rundll32.exe	rundll32.exe
PID 4808 wrote to memory of 3692	4808	rundll32.exe	rundll32.exe
PID 4808 wrote to memory of 3692	4808	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\48b58de52e1fdb863827e05424440bfe730fb210d35a8baa7239eb3127216b40.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4808

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\48b58de52e1fdb863827e05424440bfe730fb210d35a8baa7239eb3127216b40.dll,#1
2⤵
PID:3692

memory/3692-132-0x0000000000000000-mapping.dmp

Download
memory/3692-133-0x0000000001290000-0x000000000129A000-memory.dmp

Filesize
40KB

Download
memory/3692-137-0x0000000010000000-0x000000001002F000-memory.dmp

Filesize
188KB

Download