3674eafd0281b81b323973202a3274be5b81e852c32f8c4c8dc4f72d4f54e41a

Analysis

max time kernel
193s
max time network
198s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 17:16

Target

3674eafd0281b81b323973202a3274be5b81e852c32f8c4c8dc4f72d4f54e41a.dll
Size

10KB
MD5

433659cc98f0180f94d0a53ba0654711
SHA1

6ebfc58751acd1e38cdf136552f40dd272b616ad
SHA256

3674eafd0281b81b323973202a3274be5b81e852c32f8c4c8dc4f72d4f54e41a
SHA512

8ab87e35f5bbfe579750c85f1a66e93f50db5012a43ab604d7645e142567e06a5615422b05715e945cd20534adfc196369dcf6e00bb29937c47b91abe40aec53
SSDEEP

192:41mjfw8dHabRDEgzHyl0NSyFWakiP84dW3qWak8Q7dW3o9wb:48jhdHad/z20IyFWakC84dWaWak8cdWZ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 116 wrote to memory of 3484	116	rundll32.exe	rundll32.exe
PID 116 wrote to memory of 3484	116	rundll32.exe	rundll32.exe
PID 116 wrote to memory of 3484	116	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3674eafd0281b81b323973202a3274be5b81e852c32f8c4c8dc4f72d4f54e41a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:116

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3674eafd0281b81b323973202a3274be5b81e852c32f8c4c8dc4f72d4f54e41a.dll,#1
2⤵
PID:3484

memory/3484-132-0x0000000000000000-mapping.dmp

Download
memory/3484-133-0x000000006DD21000-0x000000006DD23000-memory.dmp

Filesize
8KB

Download