b16a73ebf1b732b68a589dc4d85c1323271e411c1d6eecce385034cbf85332b4

Analysis

max time kernel
84s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23/11/2022, 19:55

Target

b16a73ebf1b732b68a589dc4d85c1323271e411c1d6eecce385034cbf85332b4.dll
Size

52KB
MD5

34f60770d9fc9f3f916ae62b6b584724
SHA1

6f13221f90cb266811dd9cf6590f19d9a2cf6fb0
SHA256

b16a73ebf1b732b68a589dc4d85c1323271e411c1d6eecce385034cbf85332b4
SHA512

38f54bda14ad52f09948733f7d93fe0069e19755483db4b084be657f7607c87305177414447e8520c61ed75760f62da0c93b25659e94228ed41356f67c4f71dc
SSDEEP

768:tVGDXifqpy53Xo93T2FQJ2j0HwD8ezYOzluXl:DGDXibdo4Joo8ezxJu

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 868 wrote to memory of 4808	868	rundll32.exe	80
PID 868 wrote to memory of 4808	868	rundll32.exe	80
PID 868 wrote to memory of 4808	868	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b16a73ebf1b732b68a589dc4d85c1323271e411c1d6eecce385034cbf85332b4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:868
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b16a73ebf1b732b68a589dc4d85c1323271e411c1d6eecce385034cbf85332b4.dll,#1
  2⤵
  PID:4808

memory/4808-133-0x0000000002D50000-0x0000000002E26000-memory.dmp

Filesize
856KB

Download