9b7bd68135dfb717bc6bf1e2e1b3a7c45d371c4af16212b209b5fd28531ab68a

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 07:47

Target

9b7bd68135dfb717bc6bf1e2e1b3a7c45d371c4af16212b209b5fd28531ab68a.dll
Size

296KB
MD5

03ca7b2cc13a3b85e1bf70ba83beffe0
SHA1

e34da31e9ac8fcb7795b488839477c6d5e2c48f2
SHA256

9b7bd68135dfb717bc6bf1e2e1b3a7c45d371c4af16212b209b5fd28531ab68a
SHA512

4567771b792378b065a7fee42c150a937dfd4dc486f8f8f8a70dd3dec4cdab9da063f2598dff0ca5e96ff4406d598a43ac9c0ba0c8e34b70ef1f029025e4ff56
SSDEEP

6144:CsdaMFG231seluJgTXyVQQY8ghBGZzVRCdtAxKsmmV:C8FPFscuJsiVQQY3G9StAcmV

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2608 wrote to memory of 5092	2608	rundll32.exe	80
PID 2608 wrote to memory of 5092	2608	rundll32.exe	80
PID 2608 wrote to memory of 5092	2608	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9b7bd68135dfb717bc6bf1e2e1b3a7c45d371c4af16212b209b5fd28531ab68a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9b7bd68135dfb717bc6bf1e2e1b3a7c45d371c4af16212b209b5fd28531ab68a.dll,#1
  2⤵
  PID:5092

memory/5092-133-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download