22a2225a7f3b17c70d1f7dfab4f2aad3ecef0e9d4bdfb2f4c8ed6a5826632f43

Analysis

max time kernel
90s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 08:00

Target

22a2225a7f3b17c70d1f7dfab4f2aad3ecef0e9d4bdfb2f4c8ed6a5826632f43.dll
Size

196KB
MD5

b407d42c8515b85186dc3591707cd360
SHA1

fe8ba1e82ec2598562003f33376efe3e7f166702
SHA256

22a2225a7f3b17c70d1f7dfab4f2aad3ecef0e9d4bdfb2f4c8ed6a5826632f43
SHA512

581fef3983ad18aa643af196638cd5c93c9d3dda133927be7ad1fef9a87db0b71942a05a910c8a57b66e2bd127e59afe2bdc9c38fbf01a32579176efb40118e2
SSDEEP

3072:skDNwyLv/ENXtvsJgSZZMJwUaK2SL3T7eufp1NQ/gFkUahx9dmyTKgCVZS:skD28nj++UZRrneufVQYajhR9Ko

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 4800	2308	rundll32.exe	80
PID 2308 wrote to memory of 4800	2308	rundll32.exe	80
PID 2308 wrote to memory of 4800	2308	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\22a2225a7f3b17c70d1f7dfab4f2aad3ecef0e9d4bdfb2f4c8ed6a5826632f43.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\22a2225a7f3b17c70d1f7dfab4f2aad3ecef0e9d4bdfb2f4c8ed6a5826632f43.dll,#1
  2⤵
  PID:4800

memory/4800-133-0x0000000010000000-0x0000000010032000-memory.dmp

Filesize
200KB

Download