359f57fef1b9054813fee91492ac8ea6c98a38f9edfe25a631761d75d80ebc34

Analysis

max time kernel
139s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23/11/2022, 19:42

Target

359f57fef1b9054813fee91492ac8ea6c98a38f9edfe25a631761d75d80ebc34.dll
Size

103KB
MD5

34e23441833d95de8778d08db758018b
SHA1

c8f1baa7e80c9be6b5e082315e79e74c4051d0c5
SHA256

359f57fef1b9054813fee91492ac8ea6c98a38f9edfe25a631761d75d80ebc34
SHA512

77d871b96b0c8d772913a289fe0ca36ec8ca74324f93f83bd3aeb55c6155bb32bf8ed4ebe9714f565e44eeeca11ae5ddf46a0432bf1a942b76f0dfa219b00c85
SSDEEP

3072:Yhaan/WNjh8lkcn/28Jl7FZMKN0o9W629fx8:zaneOk228JbPusf25x

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 3752	2252	rundll32.exe	79
PID 2252 wrote to memory of 3752	2252	rundll32.exe	79
PID 2252 wrote to memory of 3752	2252	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\359f57fef1b9054813fee91492ac8ea6c98a38f9edfe25a631761d75d80ebc34.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\359f57fef1b9054813fee91492ac8ea6c98a38f9edfe25a631761d75d80ebc34.dll,#1
  2⤵
  PID:3752

memory/3752-133-0x00000000010D0000-0x00000000010DA000-memory.dmp

Filesize
40KB

Download
memory/3752-137-0x0000000010000000-0x0000000010026000-memory.dmp

Filesize
152KB

Download