445cb39640fe84aefc94af047c67353fbdc6fed8a804cc541589b35779316968

Analysis

max time kernel
92s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 16:49

Target

445cb39640fe84aefc94af047c67353fbdc6fed8a804cc541589b35779316968.dll
Size

360KB
MD5

26381d1cef6045508b51121e04636fa9
SHA1

6015b7d744b9a421221bd5589fba8a71e36e5555
SHA256

445cb39640fe84aefc94af047c67353fbdc6fed8a804cc541589b35779316968
SHA512

9866b90b056dff6ca1dad6314464b44dad4c4746e66dc5789c7d1e086a71152551d50a546056bb0fcba0c0aedbd6b3ae988e027ca4c55e138497a81928263ad3
SSDEEP

6144:awM3I4nEYm2WLZz9PGGISkraoIX4NRZLLd/BZpymJZBS+tSfEwv5wyQ:tkI4nJmRz9PGGjkrgoN9Ppymfkn

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4972 wrote to memory of 5060	4972	rundll32.exe	rundll32.exe
PID 4972 wrote to memory of 5060	4972	rundll32.exe	rundll32.exe
PID 4972 wrote to memory of 5060	4972	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\445cb39640fe84aefc94af047c67353fbdc6fed8a804cc541589b35779316968.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\445cb39640fe84aefc94af047c67353fbdc6fed8a804cc541589b35779316968.dll,#1
  2⤵
  PID:5060

memory/5060-132-0x0000000000000000-mapping.dmp

Download
memory/5060-133-0x0000000073E70000-0x0000000073ECD000-memory.dmp

Filesize
372KB

Download
memory/5060-134-0x0000000073E70000-0x0000000073ECD000-memory.dmp

Filesize
372KB

Download