b62e7f8dbadfa232a4cc7760876b2527e3e2cd09b4ed25bae087922b2d3aceca

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 18:58

Target

b62e7f8dbadfa232a4cc7760876b2527e3e2cd09b4ed25bae087922b2d3aceca.dll
Size

360KB
MD5

25f712bec4975662d841730b241231e9
SHA1

3c20d2b1eb8e3ac7a269a03629bcf360fa5ec3e4
SHA256

b62e7f8dbadfa232a4cc7760876b2527e3e2cd09b4ed25bae087922b2d3aceca
SHA512

a506d32c9e9a964f969be9489efd55750a33ba57115a92a7c07a6a2c85021831e12977fa2ec8e57a88ba3d2fff92725f81f7cc1125d660a75813745e9195019a
SSDEEP

6144:AigEwzuBmYaCDYyQi7ieC+b1taRZLLsUacr7pZ2GWLfvqffxOHF:A/LzuBHakt7ielxtaEcr7/ezF

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4656 wrote to memory of 4860	4656	rundll32.exe	rundll32.exe
PID 4656 wrote to memory of 4860	4656	rundll32.exe	rundll32.exe
PID 4656 wrote to memory of 4860	4656	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b62e7f8dbadfa232a4cc7760876b2527e3e2cd09b4ed25bae087922b2d3aceca.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4656

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b62e7f8dbadfa232a4cc7760876b2527e3e2cd09b4ed25bae087922b2d3aceca.dll,#1
2⤵
PID:4860

memory/4860-132-0x0000000000000000-mapping.dmp

Download
memory/4860-133-0x0000000073E70000-0x0000000073ECD000-memory.dmp

Filesize
372KB

Download
memory/4860-134-0x0000000073E70000-0x0000000073ECD000-memory.dmp

Filesize
372KB

Download