0755a5afd1c913cd0b1a618b532c4b8f08898b4b4f274e34beceeaed293a26b5

Analysis

max time kernel
172s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 21:10

Target

0755a5afd1c913cd0b1a618b532c4b8f08898b4b4f274e34beceeaed293a26b5.dll
Size

139KB
MD5

534975bf3f367ed7bdba85035b8f0e68
SHA1

5816f07ebbcc1a750d9296816b9b516914ce29e2
SHA256

0755a5afd1c913cd0b1a618b532c4b8f08898b4b4f274e34beceeaed293a26b5
SHA512

89e5ce2aff29543bc5bc9ac1dca0f954e4f3001de367fa2db5e81fee273a513ae25e9d03aad45e73d2d47f4df4099de9bcbc23c834df412a4e7e7c415db208f9
SSDEEP

3072:VmYMwx6thR8laweyF6QGMa0D0RIsovDG0xwga61Q5:VmK2hR7ypHDjB7GUww+

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3128 wrote to memory of 4540	3128	rundll32.exe	rundll32.exe
PID 3128 wrote to memory of 4540	3128	rundll32.exe	rundll32.exe
PID 3128 wrote to memory of 4540	3128	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0755a5afd1c913cd0b1a618b532c4b8f08898b4b4f274e34beceeaed293a26b5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3128

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0755a5afd1c913cd0b1a618b532c4b8f08898b4b4f274e34beceeaed293a26b5.dll,#1
2⤵
PID:4540

memory/4540-132-0x0000000000000000-mapping.dmp

Download
memory/4540-133-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4540-134-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4540-135-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4540-136-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4540-138-0x0000000002920000-0x0000000002AC7000-memory.dmp

Filesize
1.7MB

Download