88fc2d1a6ba13e7dcdf189f56766cb24a515f21f9d4938d967ad1f63a74b3eea

Analysis

max time kernel
94s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 06:04

Target

88fc2d1a6ba13e7dcdf189f56766cb24a515f21f9d4938d967ad1f63a74b3eea.dll
Size

74KB
MD5

59a50c4e71c1086bce270e3fb9d66284
SHA1

0a940c7e54fd5a4c11973d049f6ccd29272f408a
SHA256

88fc2d1a6ba13e7dcdf189f56766cb24a515f21f9d4938d967ad1f63a74b3eea
SHA512

0a9f47e3a9b9666ae62a26d90b62203cb1ed8de822060816aedb080e050456facdd4876f4e4399221175e9c74bb7bfaac8bd76f581f9c7c0a41243fdb5b0d97d
SSDEEP

1536:Ka5j7tWQQQkqkVgTrSiw+vU8mJqfo0XQYkk/7yO8VFCVL:KaFtWQQJBVgnS5oU8mQfVGk/2/jCV

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 4668	1756	rundll32.exe	80
PID 1756 wrote to memory of 4668	1756	rundll32.exe	80
PID 1756 wrote to memory of 4668	1756	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\88fc2d1a6ba13e7dcdf189f56766cb24a515f21f9d4938d967ad1f63a74b3eea.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\88fc2d1a6ba13e7dcdf189f56766cb24a515f21f9d4938d967ad1f63a74b3eea.dll,#1
  2⤵
  PID:4668

memory/4668-133-0x0000000000010000-0x000000000005E000-memory.dmp

Filesize
312KB

Download