3fdab6d95a6b705ac9e458f8376586294f229b148a73166d4033e1cd90375967

Analysis

max time kernel
90s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 14:30

Target

3fdab6d95a6b705ac9e458f8376586294f229b148a73166d4033e1cd90375967.dll
Size

47KB
MD5

6e8cef6d569c411028021b4e72f86a3b
SHA1

56e76b9ce2aec51c72e114f7e6bcaf5224d1906c
SHA256

3fdab6d95a6b705ac9e458f8376586294f229b148a73166d4033e1cd90375967
SHA512

66d6f8a816825f705c0f0a7b24bf2d6791b1a7107e377c167e0264831de049f93480a284d7c8f9e36f228be5302e19ff8fe42ee3f2a896ad7cbc033295315bf1
SSDEEP

768:DLWSM0k5rTfovBSYzok+5UJyHbbZsicRGBXoa3Ex5iFsHQi03/ZXffooxrz2Zb:DLWS4Bizw7bZHcRGBYacesk3/ZXXogry

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2292 wrote to memory of 4356	2292	rundll32.exe	rundll32.exe
PID 2292 wrote to memory of 4356	2292	rundll32.exe	rundll32.exe
PID 2292 wrote to memory of 4356	2292	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3fdab6d95a6b705ac9e458f8376586294f229b148a73166d4033e1cd90375967.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2292

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3fdab6d95a6b705ac9e458f8376586294f229b148a73166d4033e1cd90375967.dll,#1
2⤵
PID:4356

memory/4356-132-0x0000000000000000-mapping.dmp

Download
memory/4356-133-0x000000000097C000-0x0000000000985000-memory.dmp

Filesize
36KB

Download