0e858d86437cde4e1ff25df036003eb10fb3d345042d1c7c60ef5d28950498d9

Analysis

max time kernel
151s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 10:53

Target

0e858d86437cde4e1ff25df036003eb10fb3d345042d1c7c60ef5d28950498d9.dll
Size

48KB
MD5

78f809c95a005d764da565c4b8a6ca50
SHA1

8f1f79ce90f5281a23786724a7461deacd1e7ef1
SHA256

0e858d86437cde4e1ff25df036003eb10fb3d345042d1c7c60ef5d28950498d9
SHA512

c4ba3a51d13ceea1fde5275f9bfe947ca9216dbed8115c96631cd960a6741b3cda02c1943ed214ef40984a61119a9febc5117489a3ca492b1fac37acc4da4d25
SSDEEP

768:INXZF0M/yeqsnBkgHwYibA6wXj8fbdmiZ0a8sYwkKZ81vIO8wj6w:IvF0CxnBaYn6wQhzZ0rwk1QqGw

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3676 wrote to memory of 4784	3676	rundll32.exe	83
PID 3676 wrote to memory of 4784	3676	rundll32.exe	83
PID 3676 wrote to memory of 4784	3676	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e858d86437cde4e1ff25df036003eb10fb3d345042d1c7c60ef5d28950498d9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3676
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e858d86437cde4e1ff25df036003eb10fb3d345042d1c7c60ef5d28950498d9.dll,#1
  2⤵
  PID:4784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4784 -ip 4784
1⤵
PID:428

memory/4784-132-0x0000000000000000-mapping.dmp

Download
memory/4784-133-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download