8d5618c6c29c3cd02767e5f1edc59bc16c6a38f366793a8a4f5a626fb2c5bd99

Analysis

max time kernel
150s
max time network
170s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 18:55

Target

8d5618c6c29c3cd02767e5f1edc59bc16c6a38f366793a8a4f5a626fb2c5bd99.dll
Size

11KB
MD5

4186d3a5cdc72e3742ef093c374e44c9
SHA1

6e20b86b7cf055948da375e02da82b5d258efec9
SHA256

8d5618c6c29c3cd02767e5f1edc59bc16c6a38f366793a8a4f5a626fb2c5bd99
SHA512

ed4d7b140df1bf11f8fca81fab7600019dae58b2473073bbc7b8f495cfe8ff79a0c6616c72c1a4ec2043c74c7641fd83d08adcb0081fe51a405886bba43a4309
SSDEEP

192:yE4g6rpEP+azfDghNqLfvZu4KBrVSlWoR05+7wnz:yySm+azfRU44SB7Q

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3184 wrote to memory of 3672	3184	rundll32.exe	rundll32.exe
PID 3184 wrote to memory of 3672	3184	rundll32.exe	rundll32.exe
PID 3184 wrote to memory of 3672	3184	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8d5618c6c29c3cd02767e5f1edc59bc16c6a38f366793a8a4f5a626fb2c5bd99.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3184

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8d5618c6c29c3cd02767e5f1edc59bc16c6a38f366793a8a4f5a626fb2c5bd99.dll,#1
2⤵
PID:3672

memory/3672-132-0x0000000000000000-mapping.dmp

Download
memory/3672-133-0x0000000010000000-0x0000000010009000-memory.dmp

Filesize
36KB

Download