3cb95b22281283d3a4b74fc56e1f8409788394ee3076dd1c2396d6d683323958

Analysis

max time kernel
173s
max time network
187s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 14:32

Target

3cb95b22281283d3a4b74fc56e1f8409788394ee3076dd1c2396d6d683323958.dll
Size

501KB
MD5

dd07315e001b692fc05e32c8f3f8dc81
SHA1

ae4357f5025c141c7357fada829584221bb9b004
SHA256

3cb95b22281283d3a4b74fc56e1f8409788394ee3076dd1c2396d6d683323958
SHA512

49d51b5a6795c50a17debd41bd966637105f2456c8f54c171784f87773a9fb548494132fbda6777f3bae334b46c470b04fb0d2a0ee843a0d3baab3f16f362618
SSDEEP

12288:5eHgyLlM1U3WC1i6Opa7IVSnLTD+mO1AXNxSpPM/3LVx55rVJUCA:IHgyLlM1UuTpcmST+91AX7355x

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1432 wrote to memory of 3096	1432	rundll32.exe	rundll32.exe
PID 1432 wrote to memory of 3096	1432	rundll32.exe	rundll32.exe
PID 1432 wrote to memory of 3096	1432	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3cb95b22281283d3a4b74fc56e1f8409788394ee3076dd1c2396d6d683323958.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1432

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3cb95b22281283d3a4b74fc56e1f8409788394ee3076dd1c2396d6d683323958.dll,#1
2⤵
PID:3096

memory/3096-132-0x0000000000000000-mapping.dmp

Download
memory/3096-133-0x0000000002B50000-0x0000000002BD2000-memory.dmp

Filesize
520KB

Download
memory/3096-137-0x0000000002AD0000-0x0000000002B49000-memory.dmp

Filesize
484KB

Download