d80aef6824cc6aa935ed9c423e6761aeb299152382cb2f108481ab28e3d58437

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 18:29

Target

d80aef6824cc6aa935ed9c423e6761aeb299152382cb2f108481ab28e3d58437.dll
Size

264KB
MD5

255b0bed78eef3da3442c08f2be57789
SHA1

125a9798d45e79657ec43307ef274abff770a079
SHA256

d80aef6824cc6aa935ed9c423e6761aeb299152382cb2f108481ab28e3d58437
SHA512

5c11197e61bc088e63f483b3ccca142518d52700c4ab7041f4d6c958125fafe22f707d5b98576391b134002138d1d3c64c772c856b0174ddc1f628968eb9f544
SSDEEP

6144:BeL0KFGgYCE2L1F5A9bEGUevXvw5+zkUpfRw6XlADfUqVzGlCPKn0:BHNCE2VAmGj/zkU7dXlADfzkls40

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 5036 wrote to memory of 5000	5036	rundll32.exe	rundll32.exe
PID 5036 wrote to memory of 5000	5036	rundll32.exe	rundll32.exe
PID 5036 wrote to memory of 5000	5036	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d80aef6824cc6aa935ed9c423e6761aeb299152382cb2f108481ab28e3d58437.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5036

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d80aef6824cc6aa935ed9c423e6761aeb299152382cb2f108481ab28e3d58437.dll,#1
2⤵
PID:5000

memory/5000-132-0x0000000000000000-mapping.dmp

Download
memory/5000-133-0x000000006D220000-0x000000006D262000-memory.dmp

Filesize
264KB

Download