90b06e63bc5c7545056a138790e35649b0ed6272c3e4f2c9e708febe9cdf6764

Analysis

max time kernel
93s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 19:36

Target

90b06e63bc5c7545056a138790e35649b0ed6272c3e4f2c9e708febe9cdf6764.dll
Size

999KB
MD5

3f6fcc75eb650419251cab9e139a7372
SHA1

6b7d07ccd7fa4361d959848f6f063ddc449a0484
SHA256

90b06e63bc5c7545056a138790e35649b0ed6272c3e4f2c9e708febe9cdf6764
SHA512

5a209a403cc0aea074b6f70f75f497762432745d8f757dea86c9e9972301c2a57a29d0eb37feaa6caeda838569fd23705f8f3fda8fc3b30ffa4373a5f407b2be
SSDEEP

12288:vjc6ukBVBMlhOvya5J8lXb5L1ayzt+eF6ihCSt0sU65L5KpDX9N0EKmIRKHlbxe+:voXpe7W4/0CGvhz1ujpRh5w8T+

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1952 wrote to memory of 1944	1952	rundll32.exe	rundll32.exe
PID 1952 wrote to memory of 1944	1952	rundll32.exe	rundll32.exe
PID 1952 wrote to memory of 1944	1952	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\90b06e63bc5c7545056a138790e35649b0ed6272c3e4f2c9e708febe9cdf6764.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1952

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\90b06e63bc5c7545056a138790e35649b0ed6272c3e4f2c9e708febe9cdf6764.dll,#1
2⤵
PID:1944

memory/1944-132-0x0000000000000000-mapping.dmp

Download
memory/1944-133-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/1944-139-0x000000006EDB0000-0x000000006EDC0000-memory.dmp

Filesize
64KB

Download