860ae3f542bd047b60c96b41486d7e8d82a5b938bb6662cbf506af1c47cf84e4

Analysis

max time kernel
151s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 01:49

Target

860ae3f542bd047b60c96b41486d7e8d82a5b938bb6662cbf506af1c47cf84e4.dll
Size

39KB
MD5

1e331c07264b0a6bf56f168f381fe6e5
SHA1

3a6bdafdb0bad6fdd02914de35d581734cf3b2f5
SHA256

860ae3f542bd047b60c96b41486d7e8d82a5b938bb6662cbf506af1c47cf84e4
SHA512

7ecd95f688d8ef44afef4c76d81df52b40fb792fe846ed7c68adb42cd32b78b75616d72128deeaee6fbbbabb35232ba0ab327c463685efbaa23beaf08f00c2df
SSDEEP

768:Uf0FwkISIeJ32DyaJBkio7ckwylzdsdiVK9:Uf0uhd74io7cKl6H

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 388	2200	rundll32.exe	75
PID 2200 wrote to memory of 388	2200	rundll32.exe	75
PID 2200 wrote to memory of 388	2200	rundll32.exe	75

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\860ae3f542bd047b60c96b41486d7e8d82a5b938bb6662cbf506af1c47cf84e4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\860ae3f542bd047b60c96b41486d7e8d82a5b938bb6662cbf506af1c47cf84e4.dll,#1
  2⤵
  PID:388

memory/388-132-0x0000000000000000-mapping.dmp

Download
memory/388-133-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/388-134-0x0000000001160000-0x0000000001166000-memory.dmp

Filesize
24KB

Download
memory/388-137-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download