206bd8dc0421be37315c916916faa48bd8c57fdbe17f32217a1d30fac07ba146

Analysis

max time kernel
137s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 10:26

Target
206bd8dc0421be37315c916916faa48bd8c57fdbe17f32217a1d30fac07ba146.dll
Size 18KB
Sample221129-mgv7jsdd9w
SHA256 206bd8dc0421be37315c916916faa48bd8c57fdbe17f32217a1d30fac07ba146
MD5 5464764d2391bc92cc7c6210d91dd5c0
SHA1 1719026c6e9ba2e43a8e84f961c5b068c5dea4a8
SHA512 99e241acf169874abcd1dd6b7d5fbc9621996cc39c66df9504ec6d0b62e884a882fe60e727d0760988d6057a3394986440c81ef70c888bd325b9639dc0937471
SSDEEP 384:z/JaC64Zz0skzUmwCrzWIAmUBCiY6IH6zrVRnuwB9/VVNo0vivF:z/J3Z0snmwCWIAgiY6IHGrv9D/nNdvuF
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4520 wrote to memory of 3880	4520	rundll32.exe	80
PID 4520 wrote to memory of 3880	4520	rundll32.exe	80
PID 4520 wrote to memory of 3880	4520	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\206bd8dc0421be37315c916916faa48bd8c57fdbe17f32217a1d30fac07ba146.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4520
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\206bd8dc0421be37315c916916faa48bd8c57fdbe17f32217a1d30fac07ba146.dll,#1
  2⤵
  PID:3880

memory/3880-133-0x0000000077BA0000-0x0000000077BA6000-memory.dmp

Download

memory/3880-134-0x00000000027B0000-0x00000000027F0000-memory.dmp

Download