4f4f2a8f11562d672458bc714c59140f006951965f07c36a9701ba7c4c3e5264

Analysis

max time kernel
171s
max time network
189s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23/11/2022, 18:06

Target

4f4f2a8f11562d672458bc714c59140f006951965f07c36a9701ba7c4c3e5264.dll
Size

9KB
MD5

2756944613dfa886983e79df7e93263e
SHA1

22884efb5be1cad8c9fbd310221090a1eabda852
SHA256

4f4f2a8f11562d672458bc714c59140f006951965f07c36a9701ba7c4c3e5264
SHA512

fc9f2d9c3d4bfbc3688f55aeff49168ff5876cfeb3d81ca107ed7b0c02f4338d4b51e85990ae7ff7c06e916201c70ba377c74c276c9f543d38f80c4cc9ab9965
SSDEEP

192:L1mjfw8dHabRDEgzHyl0NSyFWakiP84dW3qWak8Q7dW3o96:L8jhdHad/z20IyFWakC84dWaWak8cdWV

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1352 wrote to memory of 1356	1352	rundll32.exe	83
PID 1352 wrote to memory of 1356	1352	rundll32.exe	83
PID 1352 wrote to memory of 1356	1352	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4f4f2a8f11562d672458bc714c59140f006951965f07c36a9701ba7c4c3e5264.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1352
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4f4f2a8f11562d672458bc714c59140f006951965f07c36a9701ba7c4c3e5264.dll,#1
  2⤵
  PID:1356

memory/1356-133-0x000000006DD21000-0x000000006DD23000-memory.dmp

Filesize
8KB

Download