ca92dca1dfb571abef876065166c9c6602df0f02c9967e281f4b51036c3b4648

Analysis

max time kernel
155s
max time network
178s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 17:21

Target

ca92dca1dfb571abef876065166c9c6602df0f02c9967e281f4b51036c3b4648.dll
Size

9KB
MD5

26db3dcf659f7c55c55341d58a53c7a5
SHA1

e97c7aa76338c49ccd0265e4e130b322c9335a75
SHA256

ca92dca1dfb571abef876065166c9c6602df0f02c9967e281f4b51036c3b4648
SHA512

93b8e085f964ecba4228ade8d8d2cab9f43f4114629a62369b2d6748b60913e5c1a6b7b94652e1afcad61d5aa32f34cbb55129611f7d0a53f847c46367d665ad
SSDEEP

192:Iw8dHabRDEgtHyl0NSypWak6HVdW3yWak8QjdW3w97:4dHad/N20IypWak8dWiWak8EdWM

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4768 wrote to memory of 1296	4768	rundll32.exe	rundll32.exe
PID 4768 wrote to memory of 1296	4768	rundll32.exe	rundll32.exe
PID 4768 wrote to memory of 1296	4768	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ca92dca1dfb571abef876065166c9c6602df0f02c9967e281f4b51036c3b4648.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4768

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ca92dca1dfb571abef876065166c9c6602df0f02c9967e281f4b51036c3b4648.dll,#1
2⤵
PID:1296

memory/1296-132-0x0000000000000000-mapping.dmp

Download
memory/1296-133-0x000000006DD21000-0x000000006DD23000-memory.dmp

Filesize
8KB

Download