befb6195f5afb76b2d4eefaeab0480f40a2df45307fa61832ab808e65e4c9558

Analysis

max time kernel
153s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 18:57

Target

befb6195f5afb76b2d4eefaeab0480f40a2df45307fa61832ab808e65e4c9558.dll
Size

360KB
MD5

44d8210c4de12489872089aa35b33d90
SHA1

74a959f1fdb29cba7b3fb129b063b5bb52549d72
SHA256

befb6195f5afb76b2d4eefaeab0480f40a2df45307fa61832ab808e65e4c9558
SHA512

259a32ed68f0af37c259881b2ae5cff371775f1888d57dec427a22ed9f72889524a5f042d48e6eee5a111648a7be7388034818d1d42216292298466686fb46eb
SSDEEP

6144:bwM3I4nEYm2WLZz9PGGISkraoIX4NRZLLd/BZpymJZBS+tSfEwv5wyQ:EkI4nJmRz9PGGjkrgoN9Ppymfkn

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3800 wrote to memory of 1604	3800	rundll32.exe	rundll32.exe
PID 3800 wrote to memory of 1604	3800	rundll32.exe	rundll32.exe
PID 3800 wrote to memory of 1604	3800	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\befb6195f5afb76b2d4eefaeab0480f40a2df45307fa61832ab808e65e4c9558.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3800

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\befb6195f5afb76b2d4eefaeab0480f40a2df45307fa61832ab808e65e4c9558.dll,#1
2⤵
PID:1604

memory/1604-132-0x0000000000000000-mapping.dmp

Download
memory/1604-133-0x0000000073E70000-0x0000000073ECD000-memory.dmp

Filesize
372KB

Download
memory/1604-134-0x0000000073E70000-0x0000000073ECD000-memory.dmp

Filesize
372KB

Download
memory/1604-135-0x0000000073E70000-0x0000000073ECD000-memory.dmp

Filesize
372KB

Download