68b729e99c40ba1f011341fa33ac3bbd4870a7bd75355ef981a84ababc5b13cf

Analysis

max time kernel
155s
max time network
189s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 18:43

Target

68b729e99c40ba1f011341fa33ac3bbd4870a7bd75355ef981a84ababc5b13cf.dll
Size

518KB
MD5

b6888d2a823cf9fed4d32432e7703e16
SHA1

21f92934f7b150d169bf191c071a944c723b7aac
SHA256

68b729e99c40ba1f011341fa33ac3bbd4870a7bd75355ef981a84ababc5b13cf
SHA512

20792fea7502fdb87026d212addf8c2e9abb833a9cde217d39ffad6685e22a504b4a9ce44e9da6c7257d75a90f70fab349723dea40fa69ff82331cc8a0c90285
SSDEEP

12288:o1WpTlpq8Nt7QCwQsWCZ8HAoKNCSIAA3q1XyDzvA:RhI87kSAoKMS83MWzY

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1376 wrote to memory of 4236	1376	rundll32.exe	rundll32.exe
PID 1376 wrote to memory of 4236	1376	rundll32.exe	rundll32.exe
PID 1376 wrote to memory of 4236	1376	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\68b729e99c40ba1f011341fa33ac3bbd4870a7bd75355ef981a84ababc5b13cf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1376

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\68b729e99c40ba1f011341fa33ac3bbd4870a7bd75355ef981a84ababc5b13cf.dll,#1
2⤵
PID:4236

memory/4236-132-0x0000000000000000-mapping.dmp

Download
memory/4236-133-0x0000000010000000-0x0000000011D02000-memory.dmp

Filesize
29.0MB

Download