45c6403eec7777a7eea11b22d47fd9064fca69415de67fff319b175d9e154cda

Analysis

max time kernel
151s
max time network
181s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 16:56

Target

45c6403eec7777a7eea11b22d47fd9064fca69415de67fff319b175d9e154cda.dll
Size

360KB
MD5

023f8e3609f28c0ff687db8a910fc443
SHA1

51bb068f38a33cc4aa7fabd1d0d7e2acb3956525
SHA256

45c6403eec7777a7eea11b22d47fd9064fca69415de67fff319b175d9e154cda
SHA512

dd3303e4d3d34fdc574905054e7178f2a8ef58dda89fb23eb118c58da41a6bf284c17ba2cb83b343dc2931d8694d370aa085d7f4177c231bbdad9a1127085a2f
SSDEEP

6144:bwM3I4nEYm2WLZz9PGGISkraoIX4NRZLLd/BZpymJZBS+tSfEwv5wyQ:EkI4nJmRz9PGGjkrgoN9Ppymfkn

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4540 wrote to memory of 4640	4540	rundll32.exe	rundll32.exe
PID 4540 wrote to memory of 4640	4540	rundll32.exe	rundll32.exe
PID 4540 wrote to memory of 4640	4540	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\45c6403eec7777a7eea11b22d47fd9064fca69415de67fff319b175d9e154cda.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4540

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\45c6403eec7777a7eea11b22d47fd9064fca69415de67fff319b175d9e154cda.dll,#1
2⤵
PID:4640

memory/4640-132-0x0000000000000000-mapping.dmp

Download
memory/4640-133-0x0000000073E70000-0x0000000073ECD000-memory.dmp

Filesize
372KB

Download
memory/4640-134-0x0000000073E70000-0x0000000073ECD000-memory.dmp

Filesize
372KB

Download