f51c85ef4095852015d1bf9e3d7e94f16485fd50d9e5b3bf4f6ed9c25b8b00ba

Analysis

max time kernel
95s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23/11/2022, 19:59

Target

f51c85ef4095852015d1bf9e3d7e94f16485fd50d9e5b3bf4f6ed9c25b8b00ba.dll
Size

98KB
MD5

04abfb8601575fcc13cfa8561cef1895
SHA1

7ee43c108304752189bb153ece383161ace9fb41
SHA256

f51c85ef4095852015d1bf9e3d7e94f16485fd50d9e5b3bf4f6ed9c25b8b00ba
SHA512

a2281a1624a9983bec713db79ce2e92d77c7b57c6ac3887e6f48c6955141805cd30520c5392e00012d643a026afeb7160288de473a7d1e3526d2ffeb932dc174
SSDEEP

1536:0pstl9F0gv/r7r2ZA+2rqohx9fbE4VtJj+35ADrEOK3xnGlyZ:0OtFNv/r7r0A+kNDJ443s3GDgOK3xDZ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3488 wrote to memory of 3720	3488	rundll32.exe	81
PID 3488 wrote to memory of 3720	3488	rundll32.exe	81
PID 3488 wrote to memory of 3720	3488	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f51c85ef4095852015d1bf9e3d7e94f16485fd50d9e5b3bf4f6ed9c25b8b00ba.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3488
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f51c85ef4095852015d1bf9e3d7e94f16485fd50d9e5b3bf4f6ed9c25b8b00ba.dll,#1
  2⤵
  PID:3720

memory/3720-133-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download