1c7bf208aba566dbee259bc43ed32765cc6eacd4b0e8fd1402a548ce0d9b0287

Analysis

max time kernel
153s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 19:02

Target

1c7bf208aba566dbee259bc43ed32765cc6eacd4b0e8fd1402a548ce0d9b0287.dll
Size

274KB
MD5

1a3650b8567d5ebe8eb8b26c16c50067
SHA1

b44b2729b4833f158c25c938c5685b44d2b95338
SHA256

1c7bf208aba566dbee259bc43ed32765cc6eacd4b0e8fd1402a548ce0d9b0287
SHA512

a47fb2529b5460ddf5814d81078ecf526a9b9535442f26a36f994a9e7e15d5515cb0fbefc06e896f60980ea37d9f168edfa1c4dd06fa356d21ead5d3267f13f6
SSDEEP

6144:vOSjIXo9jPDv5eisvDs8W7s9ZuJrUO//oOqzTzlUK/zNFe5kQn:2549zDUis7s8W7GYAOqWAMiQ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1868 wrote to memory of 1748	1868	rundll32.exe	rundll32.exe
PID 1868 wrote to memory of 1748	1868	rundll32.exe	rundll32.exe
PID 1868 wrote to memory of 1748	1868	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1c7bf208aba566dbee259bc43ed32765cc6eacd4b0e8fd1402a548ce0d9b0287.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1868

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1c7bf208aba566dbee259bc43ed32765cc6eacd4b0e8fd1402a548ce0d9b0287.dll,#1
2⤵
PID:1748

memory/1748-132-0x0000000000000000-mapping.dmp

Download
memory/1748-133-0x00000000736D0000-0x000000007371C000-memory.dmp

Filesize
304KB

Download