df0e3db6b5935ddba0a4fe066aedd5e15aab0418a552252b9f203ed328fe0e18

Analysis

max time kernel
108s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 13:37

Target

df0e3db6b5935ddba0a4fe066aedd5e15aab0418a552252b9f203ed328fe0e18.dll
Size

53KB
MD5

05b7ba5c73e9b59487c9e45da6bc2003
SHA1

9e6dec92e0628361788e93e048380cde30aac43e
SHA256

df0e3db6b5935ddba0a4fe066aedd5e15aab0418a552252b9f203ed328fe0e18
SHA512

3df3c269313b87cf9e120e8a29178a49416ee86f48981606b2f57e3f6350f47ba4f4bc119f6dad79d49ef99bc17a83530e52f17659c2b2ec6e7ddfcf6484fe5e
SSDEEP

768:JSuqAQkwzS3zrkP4XFw7D9ZYRbDziWAy4fE5FmoJMss4eXtysu/WULK0tK:guqAQSkAXFGYTA9E5YoJcXm/WULKMK

Score

8^/10

Blocklisted process makes network request 3 IoCs

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4956	rundll32.exe
4956	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5064 wrote to memory of 4956	5064	rundll32.exe	81
PID 5064 wrote to memory of 4956	5064	rundll32.exe	81
PID 5064 wrote to memory of 4956	5064	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\df0e3db6b5935ddba0a4fe066aedd5e15aab0418a552252b9f203ed328fe0e18.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\df0e3db6b5935ddba0a4fe066aedd5e15aab0418a552252b9f203ed328fe0e18.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:4956