bd390872d65b204ade0ea17d059b5da84ff16062a023171bd538d911be46d6b2

Analysis

max time kernel
160s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 07:43

Target

bd390872d65b204ade0ea17d059b5da84ff16062a023171bd538d911be46d6b2.dll
Size

196KB
MD5

b397566d31c26d5d9ce3300718feb980
SHA1

2d31ff32b6a726f6e66c788ab14478167f0bc41a
SHA256

bd390872d65b204ade0ea17d059b5da84ff16062a023171bd538d911be46d6b2
SHA512

eb5c75d51490edc4dd069add5e52b8a7bb3fc264be92e11072fc44db6676ff57e533c573eed6e12729a20fed42beaebeebf5f4f121dd6e3dfbdfe9e9fc524921
SSDEEP

3072:sknNwyLv/ENXtvM0vbvJkZEYF/ya/+v3EXe7PqZdvF0lM:skn28IK7Bya3Xe7ialM

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 2000	1124	rundll32.exe	81
PID 1124 wrote to memory of 2000	1124	rundll32.exe	81
PID 1124 wrote to memory of 2000	1124	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd390872d65b204ade0ea17d059b5da84ff16062a023171bd538d911be46d6b2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd390872d65b204ade0ea17d059b5da84ff16062a023171bd538d911be46d6b2.dll,#1
  2⤵
  PID:2000

memory/2000-133-0x0000000010000000-0x0000000010032000-memory.dmp

Filesize
200KB

Download