14df33409f6d3194ec2bebbacee06dd9d46dc79e5b65fb93f67f8a818cccf5c0

Analysis

max time kernel
203s
max time network
206s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 06:23

Target

14df33409f6d3194ec2bebbacee06dd9d46dc79e5b65fb93f67f8a818cccf5c0.dll
Size

129KB
MD5

2240b490922e5e55df320837205dcb32
SHA1

83deaaaf21d3d811da1ac0a8908ea073c792638c
SHA256

14df33409f6d3194ec2bebbacee06dd9d46dc79e5b65fb93f67f8a818cccf5c0
SHA512

f22790fed6d18cdc5da5508be7cb9a13e6c5f2c86308a314b09895569bd52671f86ed7c518d4c2b2296fd62d93e6521b5c4cb72fb6ff05274f32e9e45a0030a3
SSDEEP

3072:jcSE314Q68iA0YmaWu+Ocp+KORGs73xZIwElpmWYDyFUc4cKabxY0:O14QhiRahr8/ORG23wnlMWxd4cKa

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4456 wrote to memory of 4680	4456	rundll32.exe	79
PID 4456 wrote to memory of 4680	4456	rundll32.exe	79
PID 4456 wrote to memory of 4680	4456	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\14df33409f6d3194ec2bebbacee06dd9d46dc79e5b65fb93f67f8a818cccf5c0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4456
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\14df33409f6d3194ec2bebbacee06dd9d46dc79e5b65fb93f67f8a818cccf5c0.dll,#1
  2⤵
  PID:4680

memory/4680-132-0x0000000000000000-mapping.dmp

Download
memory/4680-133-0x00000000012D0000-0x00000000012E2000-memory.dmp

Filesize
72KB

Download
memory/4680-134-0x0000000002B20000-0x0000000002B43000-memory.dmp

Filesize
140KB

Download
memory/4680-138-0x00000000012D0000-0x00000000012E2000-memory.dmp

Filesize
72KB

Download