ca3c6aa65d838e2164af3b43a370e35dadd96938d8da0347cffe30cfa19cb3f3

Analysis

max time kernel
139s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2022 07:41

Target

lolyhzs_veryhuo.com/SKT.dll
Size

99KB
MD5

6c4680f6a837be4452fdc956dc3cb94a
SHA1

b3c09ca7bace0f306be095de956a165562c4c71c
SHA256

0f0b84c97a667ed614cdeaca5afdb6a1742438a262ba926e9320039c4c97cd0b
SHA512

6d1b6ddaff443935a8c221b9bc9e9bbf568078ea7b75262b52da2e06f7ab8f8ec19120e0511211e3725026683f8d294ac4fe175a21d4182a1da563cf6b755614
SSDEEP

1536:iKc9rgArUR/fzxFpjPhFFwwAhteeLceTay6oYrGKQ9c10H7IgKVqq0n:iKoUp9FprhFFwwk0N3oYr1QPEfVqX

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2772 wrote to memory of 4956	2772	rundll32.exe	rundll32.exe
PID 2772 wrote to memory of 4956	2772	rundll32.exe	rundll32.exe
PID 2772 wrote to memory of 4956	2772	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\lolyhzs_veryhuo.com\SKT.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2772

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\lolyhzs_veryhuo.com\SKT.dll,#1
2⤵
PID:4956

memory/4956-132-0x0000000000000000-mapping.dmp

Download
memory/4956-133-0x0000000010000000-0x0000000010029000-memory.dmp

Filesize
164KB

Download