e1191ddd30928befeb253af4ff74c8d78a985f9909bdf80d8bb27a38160f73d0

Analysis

max time kernel
197s
max time network
215s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
28-11-2022 06:17

Target

e1191ddd30928befeb253af4ff74c8d78a985f9909bdf80d8bb27a38160f73d0.dll
Size

169KB
MD5

8259695f2aa973a6545df3785aca9ca1
SHA1

c05aab287649c26812ac0abf1fa1129256909433
SHA256

e1191ddd30928befeb253af4ff74c8d78a985f9909bdf80d8bb27a38160f73d0
SHA512

436da43fe8f2c977dab7a22417c4bd2392cbea457fbd5826854c22503c0f6498cf71bf1c43cc1ae0b7f5ec4e37a07c37a5a612acc56f31bcebf82fd3bb113df8
SSDEEP

3072:NdBvRfKMft58yBvlx35CgF4qSJ3hU3e5:NdBvvBvb35ZF3SJ3

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1984 wrote to memory of 900	1984	rundll32.exe	rundll32.exe
PID 1984 wrote to memory of 900	1984	rundll32.exe	rundll32.exe
PID 1984 wrote to memory of 900	1984	rundll32.exe	rundll32.exe
PID 900 wrote to memory of 4976	900	rundll32.exe	notepad.exe
PID 900 wrote to memory of 4976	900	rundll32.exe	notepad.exe
PID 900 wrote to memory of 4976	900	rundll32.exe	notepad.exe
PID 900 wrote to memory of 4976	900	rundll32.exe	notepad.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e1191ddd30928befeb253af4ff74c8d78a985f9909bdf80d8bb27a38160f73d0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e1191ddd30928befeb253af4ff74c8d78a985f9909bdf80d8bb27a38160f73d0.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:900
- - C:\Windows\SysWOW64\notepad.exe
    C:\Windows\System32\notepad.exe
    3⤵
    PID:4976

memory/900-132-0x0000000000000000-mapping.dmp

Download
memory/4976-133-0x0000000000000000-mapping.dmp

Download
memory/4976-134-0x0000000000D40000-0x0000000000D5B000-memory.dmp

Filesize
108KB

Download
memory/4976-135-0x0000000002B80000-0x0000000002BA3000-memory.dmp

Filesize
140KB

Download