1379fd67588484b8817a50e5fdfb37ced156e44b3a4f0fdd466409e481733ef5

Analysis

max time kernel
121s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 22:40

Target

ʹ֮/VAuth.dll
Size

204KB
MD5

c40453613720f82ed07058b0c336ceae
SHA1

bec37046da533adfd79a4db3de00c93198b30e36
SHA256

6d9fae2f550391d6510523ec443278be45a62178e87de0bf644d22f0c4a40d91
SHA512

eacf9b084adbbfb1f4cae7a7966982d98b0578a5aa9905237c73ec9491b898ba38d75b360993d8c6439b548660ea514c8de2f684f4a10e3c0cd1b1a7df973df8
SSDEEP

3072:Qme1GvjCRltauHGw87EtG5uJtYXdGpdzEwpYaEpMc91+7atMnQ:cuCn3y7EtGGGdGph7pYaEpZ1+3n

Score

8^/10

Blocklisted process makes network request 4 IoCs

Processes:

rundll32.exe

flow pid process

2 1560 rundll32.exe
7 1560 rundll32.exe
9 1560 rundll32.exe
15 1560 rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4740 wrote to memory of 1560	4740	rundll32.exe	rundll32.exe
PID 4740 wrote to memory of 1560	4740	rundll32.exe	rundll32.exe
PID 4740 wrote to memory of 1560	4740	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ʹ֮\VAuth.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ʹ֮\VAuth.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:1560