72d938309f0e5965a7a9f397f1aba3150e844dc36b01a26cffe4209c6b8b219a

Analysis

max time kernel
132s
max time network
185s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 17:08

Target

72d938309f0e5965a7a9f397f1aba3150e844dc36b01a26cffe4209c6b8b219a.dll
Size

18KB
MD5

9cd5980154b50693dfb2e4a2186c1190
SHA1

09ed92aaa79e4e8cc9a884aa327b0acec7ec850e
SHA256

72d938309f0e5965a7a9f397f1aba3150e844dc36b01a26cffe4209c6b8b219a
SHA512

1cdee4b5f3641c7d10469203671588e922622344a1e6141aba18dd2043dda5c4269c7d592ab9c6836fb03efa028cfc4cb98f91fcbb657acb8e5ba57162243a63
SSDEEP

384:fCiGC+GoC37M6F0yWqYkD68P5V+oErc60viKAVh/:6iO27MUWXkv5V+oErcXvnqp

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 620 wrote to memory of 1556	620	rundll32.exe	80
PID 620 wrote to memory of 1556	620	rundll32.exe	80
PID 620 wrote to memory of 1556	620	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\72d938309f0e5965a7a9f397f1aba3150e844dc36b01a26cffe4209c6b8b219a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:620
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\72d938309f0e5965a7a9f397f1aba3150e844dc36b01a26cffe4209c6b8b219a.dll,#1
  2⤵
  PID:1556

memory/1556-133-0x0000000077BA0000-0x0000000077BA6000-memory.dmp

Filesize
24KB

Download
memory/1556-134-0x00000000025B0000-0x00000000025F0000-memory.dmp

Filesize
256KB

Download