23989294a71f0a4cd07b57030f728801c511d2b665df7031509cff9ad70540d5

Analysis

max time kernel
131s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 06:18

Target

23989294a71f0a4cd07b57030f728801c511d2b665df7031509cff9ad70540d5.dll
Size

331KB
MD5

36517b76a845597785e8d88529648e35
SHA1

cf768aece7ee393318c30de0dc6af1fb4b1fafa4
SHA256

23989294a71f0a4cd07b57030f728801c511d2b665df7031509cff9ad70540d5
SHA512

18e8fcaa9ca3dd69d436224499c0b3856fff11e87289a7f3a86f98808b5e8c456f44bf80d5407c5d9e286b172903c3d63c1a97f5178e40f9b618e74aa3f84617
SSDEEP

6144:elds4wAOHTTkGq/Hlgaq4dFK3lyn1q+/jst8KHfjIckkQYdWihh19:enwA+TolFgQFf1q+/4ttHfjIc7Qk

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1308 wrote to memory of 1328	1308	rundll32.exe	81
PID 1308 wrote to memory of 1328	1308	rundll32.exe	81
PID 1308 wrote to memory of 1328	1308	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\23989294a71f0a4cd07b57030f728801c511d2b665df7031509cff9ad70540d5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\23989294a71f0a4cd07b57030f728801c511d2b665df7031509cff9ad70540d5.dll,#1
  2⤵
  PID:1328

memory/1328-132-0x0000000000000000-mapping.dmp

Download
memory/1328-133-0x0000000010000000-0x0000000010032000-memory.dmp

Filesize
200KB

Download