9dbf567d3fe99e96a18201c213408424f30c08fcbac48e75770c3cbd4f7975a2

Analysis

max time kernel
175s
max time network
195s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 19:10

Target

9dbf567d3fe99e96a18201c213408424f30c08fcbac48e75770c3cbd4f7975a2.dll
Size

3.8MB
MD5

05a2736e29ee1a1b23e4462f426169bc
SHA1

a5a29f653e3aa152b19b4c7b52c0efd7a84a09d3
SHA256

9dbf567d3fe99e96a18201c213408424f30c08fcbac48e75770c3cbd4f7975a2
SHA512

d78416d202ce4ab7c7f31b7d2cccc98f7a911545763be595cb1cc0bdd77e4ad0b57cd983c345a1179426512d59dc2f43af5ee0ec37c35ccdba93c87356428828
SSDEEP

98304:gJJZjyGBivO9yKVA9PnEbKrKkVo9ymVGby/uT8auKz2zCRFByMjMNmnN0aD:gJJZjyGBivO9yKVANnEbKrKkVorVGbyc

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3064 wrote to memory of 4528	3064	rundll32.exe	rundll32.exe
PID 3064 wrote to memory of 4528	3064	rundll32.exe	rundll32.exe
PID 3064 wrote to memory of 4528	3064	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9dbf567d3fe99e96a18201c213408424f30c08fcbac48e75770c3cbd4f7975a2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3064

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9dbf567d3fe99e96a18201c213408424f30c08fcbac48e75770c3cbd4f7975a2.dll,#1
2⤵
PID:4528

memory/4528-132-0x0000000000000000-mapping.dmp

Download
memory/4528-133-0x0000000024000000-0x000000002443D000-memory.dmp

Filesize
4.2MB

Download