9256bb50088c03ee383ee8250e9887ccd8c638df1dab81553e8c894a58a1a622

Analysis

max time kernel
232s
max time network
228s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 18:49

Target

9256bb50088c03ee383ee8250e9887ccd8c638df1dab81553e8c894a58a1a622.dll
Size

724KB
MD5

4381595133f89781e09f9f253cd0c680
SHA1

29e82c4a08a55b084e08a01c711f2354f8538617
SHA256

9256bb50088c03ee383ee8250e9887ccd8c638df1dab81553e8c894a58a1a622
SHA512

785c026f4102d564837557d11ad1adeab178ff25fecf6a5473902707d9ff2dcedee0d38bc23d75e79f57f24d845680aaca5647b3762622c7c65660e9a290edac
SSDEEP

12288:aT7JBmznQYkRcIiLyyrcRsix7mRHIpL5IPvchXGM+36Yw/4Xgr8KecVWtzKPdSJD:aT7JBmzn8cIiLyyrcKipmRHIpL5IPvca

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1424 wrote to memory of 1968	1424	rundll32.exe	rundll32.exe
PID 1424 wrote to memory of 1968	1424	rundll32.exe	rundll32.exe
PID 1424 wrote to memory of 1968	1424	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9256bb50088c03ee383ee8250e9887ccd8c638df1dab81553e8c894a58a1a622.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1424

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9256bb50088c03ee383ee8250e9887ccd8c638df1dab81553e8c894a58a1a622.dll,#1
2⤵
PID:1968

memory/1968-132-0x0000000000000000-mapping.dmp

Download
memory/1968-133-0x0000000060000000-0x00000000600B5000-memory.dmp

Filesize
724KB

Download