8b7948fe7a0eb413cddc58f75973c6cf148673a8786095601c0b71057c6ff14f

Analysis

max time kernel
91s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 05:48

Target

8b7948fe7a0eb413cddc58f75973c6cf148673a8786095601c0b71057c6ff14f.dll
Size

84KB
MD5

883d838026fbe26792787636b77fc2a5
SHA1

cd45a2641a84d4872520bbb1df6addbec187e614
SHA256

8b7948fe7a0eb413cddc58f75973c6cf148673a8786095601c0b71057c6ff14f
SHA512

943fcf112a7154890338eef7708cc9a973d49510ec5a0c6976860e6cf7ba095ceab8f30aac8a6e80364b1b3ee313fc84e6e3029cd87073438bb8dc1f193d7330
SSDEEP

1536:JB0uvsyn0B7rFQiDkUVWCcZ0HdI5x+1AA0qeTiyjD8LxveyT4SE:Je8sthRQiDkqyZ0uD+D0qeTiaGxWyJE

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5036 wrote to memory of 4944	5036	rundll32.exe	81
PID 5036 wrote to memory of 4944	5036	rundll32.exe	81
PID 5036 wrote to memory of 4944	5036	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8b7948fe7a0eb413cddc58f75973c6cf148673a8786095601c0b71057c6ff14f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8b7948fe7a0eb413cddc58f75973c6cf148673a8786095601c0b71057c6ff14f.dll,#1
  2⤵
  PID:4944

memory/4944-133-0x0000000000DD0000-0x0000000000DDD000-memory.dmp

Filesize
52KB

Download
memory/4944-135-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download
memory/4944-138-0x0000000000DD0000-0x0000000000DDD000-memory.dmp

Filesize
52KB

Download