325f1d50121037b6c9245bd40a806c32ebb3a78e49cbbf41784e6310e7271489

Analysis

max time kernel
192s
max time network
203s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23/11/2022, 19:39

Target

325f1d50121037b6c9245bd40a806c32ebb3a78e49cbbf41784e6310e7271489.dll
Size

62KB
MD5

535f4373d25845214c3f74b29c439890
SHA1

8550221885a8864081ae9f7908aa3188b0951bb5
SHA256

325f1d50121037b6c9245bd40a806c32ebb3a78e49cbbf41784e6310e7271489
SHA512

cc1021d55a352e5f514e649e45cfd3d00c9005221805d213d021c78bf08dfb25d9a2f8893aa58f3a67a9df9a9bb6f5123f7ecc7cf06fca0e91dc3c0b2b22d525
SSDEEP

1536:csACrzAGELVgUHCG5wbPIeO0aJpBc4iEjtW6WBA:FUGTle4wuaJpBbL0T

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2628 wrote to memory of 5076	2628	rundll32.exe	80
PID 2628 wrote to memory of 5076	2628	rundll32.exe	80
PID 2628 wrote to memory of 5076	2628	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\325f1d50121037b6c9245bd40a806c32ebb3a78e49cbbf41784e6310e7271489.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\325f1d50121037b6c9245bd40a806c32ebb3a78e49cbbf41784e6310e7271489.dll,#1
  2⤵
  PID:5076

memory/5076-134-0x0000000074AE0000-0x0000000074B0D000-memory.dmp

Filesize
180KB

Download
memory/5076-133-0x0000000074AE0000-0x0000000074B0D000-memory.dmp

Filesize
180KB

Download
memory/5076-135-0x0000000074AE0000-0x0000000074B0D000-memory.dmp

Filesize
180KB

Download