f48b23d0a3cfd8eff1aff4db9a601892327506fab735906869a6fa8f0b729605

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 18:59

Target

f48b23d0a3cfd8eff1aff4db9a601892327506fab735906869a6fa8f0b729605.dll
Size

652KB
MD5

3f94944ad7470233f63bd723f81d6104
SHA1

b55b68d3e68e64cadba8202737d3f1e404e3966a
SHA256

f48b23d0a3cfd8eff1aff4db9a601892327506fab735906869a6fa8f0b729605
SHA512

5712cdd12f08e3bf1d96c92502051298ae1800d3cc2b0defd9ebe02b4a0448b29c927a37efa942c1ebd875d902a61b36fb1eef38e42b05ba35a96bd985e762f2
SSDEEP

12288:euYZhMltDoD+OSt+9jajk5RnchUgiW6QR7t553Ooc8NHkC2euBG8fnyAQ:dOhMltDoqvCjajk59g3Ooc8NHkC2eWGB

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4920 wrote to memory of 4956	4920	rundll32.exe	rundll32.exe
PID 4920 wrote to memory of 4956	4920	rundll32.exe	rundll32.exe
PID 4920 wrote to memory of 4956	4920	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f48b23d0a3cfd8eff1aff4db9a601892327506fab735906869a6fa8f0b729605.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4920

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f48b23d0a3cfd8eff1aff4db9a601892327506fab735906869a6fa8f0b729605.dll,#1
2⤵
PID:4956

memory/4956-132-0x0000000000000000-mapping.dmp

Download
memory/4956-133-0x000000007C420000-0x000000007C4C4000-memory.dmp

Filesize
656KB

Download