e3500d36c4386966d6d2c44d5548351efa018fb035847c9292cc55bc8c80a68c

Analysis

max time kernel
140s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 10:53

Target

e3500d36c4386966d6d2c44d5548351efa018fb035847c9292cc55bc8c80a68c.dll
Size

305KB
MD5

286a7107c09b0f8c0a98470f18658f59
SHA1

7d53536cd5af8a5ed75f1da8567218daf4744881
SHA256

e3500d36c4386966d6d2c44d5548351efa018fb035847c9292cc55bc8c80a68c
SHA512

99177b0888696837dad034a985dbfdaec70c9e829e9de4f9fd99c1ed93462d7d8be507fe5d7720e3425d259ce1afd433238c90426c36181dc0e2dfc88569384d
SSDEEP

6144:huBFnY78dgeBp6YMTE7q6Eru9DM5A2EMc5vwqrb:wHnO8dgeB6Th6bJM5mMc5Xb

Score

1^/10

Suspicious behavior: EnumeratesProcesses 16 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4556 wrote to memory of 1700	4556	rundll32.exe	79
PID 4556 wrote to memory of 1700	4556	rundll32.exe	79
PID 4556 wrote to memory of 1700	4556	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e3500d36c4386966d6d2c44d5548351efa018fb035847c9292cc55bc8c80a68c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4556
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e3500d36c4386966d6d2c44d5548351efa018fb035847c9292cc55bc8c80a68c.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1700

memory/1700-133-0x0000000000E70000-0x0000000000EAE000-memory.dmp

Filesize
248KB

Download
memory/1700-134-0x0000000000EB0000-0x0000000000EB4000-memory.dmp

Filesize
16KB

Download