e5dc94bb0509f9d805cd2fd1e0c097b484a91ca966e7ded8c623c95c5266578c

Analysis

max time kernel
139s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23/11/2022, 20:08

Target

e5dc94bb0509f9d805cd2fd1e0c097b484a91ca966e7ded8c623c95c5266578c.dll
Size

64KB
MD5

44ed11e1b40d67662629fc909a9b93b5
SHA1

836f1464f0ae247d31767948b02153e23933fc9e
SHA256

e5dc94bb0509f9d805cd2fd1e0c097b484a91ca966e7ded8c623c95c5266578c
SHA512

c9e26f99498f9e39d93f8188a16df6670bfe014a4b36af1536cf272bfb0fd2977b235e611d0f19fcf3523a255c2a1ebc10244926162bd476ca909b16e1ed462d
SSDEEP

1536:g2NNyGkHjkDzELujg+4Az8fuw/35x/4UihkHeTrtW8/:guAGWIz8ggCofuw/YjuH8tb

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 4928	5048	rundll32.exe	79
PID 5048 wrote to memory of 4928	5048	rundll32.exe	79
PID 5048 wrote to memory of 4928	5048	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e5dc94bb0509f9d805cd2fd1e0c097b484a91ca966e7ded8c623c95c5266578c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e5dc94bb0509f9d805cd2fd1e0c097b484a91ca966e7ded8c623c95c5266578c.dll,#1
  2⤵
  PID:4928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4928 -ip 4928
1⤵
PID:5088

memory/4928-133-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download