38eb1d4883e74b3727e3587bc34f3f6f8cfa4f45299e940870ba55b57aa7d243

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 07:58

Target

38eb1d4883e74b3727e3587bc34f3f6f8cfa4f45299e940870ba55b57aa7d243.dll
Size

284KB
MD5

b581ebc87332a0aceb96b09458955790
SHA1

55b89e57dd83d593ff0bb1f24934ebbd8f57e3f8
SHA256

38eb1d4883e74b3727e3587bc34f3f6f8cfa4f45299e940870ba55b57aa7d243
SHA512

29cf76cd09869a9aa19d12f0f088aef04412a5767c2f31496fd28613fa1a7ab633edc9023bc83c2c92a02882f95b7d1b36e7e5bd7f78feac1f83ff65e72e802d
SSDEEP

6144:skS28Plv3XmYUrrJtxFAkFPMnXePyv+60ozrPDKCJzw9QsONfvwG:m28dPRyLNFPMXCyGOzrPBw16IG

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4408 wrote to memory of 2256	4408	rundll32.exe	82
PID 4408 wrote to memory of 2256	4408	rundll32.exe	82
PID 4408 wrote to memory of 2256	4408	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\38eb1d4883e74b3727e3587bc34f3f6f8cfa4f45299e940870ba55b57aa7d243.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4408
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\38eb1d4883e74b3727e3587bc34f3f6f8cfa4f45299e940870ba55b57aa7d243.dll,#1
  2⤵
  PID:2256

memory/2256-133-0x0000000010000000-0x0000000010048000-memory.dmp

Filesize
288KB

Download