21cec264e25ecd068677c642021ab85a39af414ec1038e7a34c087dc6f9a3c23

Analysis

max time kernel
161s
max time network
178s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 19:02

Target

21cec264e25ecd068677c642021ab85a39af414ec1038e7a34c087dc6f9a3c23.dll
Size

380KB
MD5

25e952c352c071938e11922b7e8b1bf7
SHA1

12ee57e0ee4e87dc5fe2d1b647ca277efccceb28
SHA256

21cec264e25ecd068677c642021ab85a39af414ec1038e7a34c087dc6f9a3c23
SHA512

5f3bfd626c4551e9051ca973bb638775b8c1f842d7780acd486361405a8ed8c303b6a01bb3e3e6369c1eb103d591389df5b7a293437a88aebc4c3fbdc4c4135d
SSDEEP

6144:iu7GpiAU4d/FgXb1SNfuvCLDVxvWRSG+ctTaZnGj6hLpai9l0732AYms3cfHQKUr:iu7GpI4dt8bk9uvO6wG+AaZBa32z5uHS

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

rundll32.exe

pid process

4788 rundll32.exe

pid	process
4788	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 5004 wrote to memory of 4788	5004	rundll32.exe	rundll32.exe
PID 5004 wrote to memory of 4788	5004	rundll32.exe	rundll32.exe
PID 5004 wrote to memory of 4788	5004	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\21cec264e25ecd068677c642021ab85a39af414ec1038e7a34c087dc6f9a3c23.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5004

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\21cec264e25ecd068677c642021ab85a39af414ec1038e7a34c087dc6f9a3c23.dll,#1
2⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:4788

memory/4788-132-0x0000000000000000-mapping.dmp

Download
memory/4788-133-0x0000000010000000-0x0000000010063000-memory.dmp

Filesize
396KB

Download