b4f2a92ed3b9ae4d3227c7f3f2b76da0d437e7ea0b9cb2350c7057552ecf2e5b

Analysis

max time kernel
151s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2022 22:57

Target

b4f2a92ed3b9ae4d3227c7f3f2b76da0d437e7ea0b9cb2350c7057552ecf2e5b.dll
Size

18KB
MD5

bb991ec29a6e275e2a30f8308bd00ce4
SHA1

39171b62a2552203f52759ffc9004fad7b4ea84c
SHA256

b4f2a92ed3b9ae4d3227c7f3f2b76da0d437e7ea0b9cb2350c7057552ecf2e5b
SHA512

0160b5efe1adced898b811d32fdf19cc87576dcd011e61fda87d6688ac6692c56ed57d452274a04e1a9a8d065645a3fb2a545409059ed1aef1e0f5a0818fb42d
SSDEEP

384:EiBHo7xX9iGgOa7Pfp+/BRiBZWG5VL3ArCQBY+B7TUXiaPO7DfkKD:EP7TiGgH7PR8BnKVL3T+B7gXXPwkm

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 4736	2548	rundll32.exe	85
PID 2548 wrote to memory of 4736	2548	rundll32.exe	85
PID 2548 wrote to memory of 4736	2548	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b4f2a92ed3b9ae4d3227c7f3f2b76da0d437e7ea0b9cb2350c7057552ecf2e5b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b4f2a92ed3b9ae4d3227c7f3f2b76da0d437e7ea0b9cb2350c7057552ecf2e5b.dll,#1
  2⤵
  PID:4736

memory/4736-133-0x0000000077BA0000-0x0000000077BA6000-memory.dmp

Filesize
24KB

Download
memory/4736-134-0x0000000002BB0000-0x0000000002BF0000-memory.dmp

Filesize
256KB

Download