8a80469a2297ae5466b121a6641282f014d711729362f758e47f223d83980aa9

Analysis

max time kernel
181s
max time network
195s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 01:19

Target

8a80469a2297ae5466b121a6641282f014d711729362f758e47f223d83980aa9.dll
Size

37KB
MD5

822d3d942f3bd34e5b7c9f0328dcec2d
SHA1

577495c909bab1f955290850bbb17cf08a33bb5f
SHA256

8a80469a2297ae5466b121a6641282f014d711729362f758e47f223d83980aa9
SHA512

8f7cd81d162904a8fd4f4956122ebffe408fad30484ae150bdd930c2bbef1aa6593017e7e8ed47a6be0116afb7ca0f9d3652b130c5151e6a43b04a88c144a98c
SSDEEP

768:CNETtlYh7jtUvJRTWaCdH1W+c8K6KWjepsUJg3ukx+CN:Cy6tUvyE+c8Kd+epsUEu

Score

1^/10

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4636 wrote to memory of 2420	4636	rundll32.exe	84
PID 4636 wrote to memory of 2420	4636	rundll32.exe	84
PID 4636 wrote to memory of 2420	4636	rundll32.exe	84
PID 2420 wrote to memory of 2488	2420	rundll32.exe	85
PID 2420 wrote to memory of 2488	2420	rundll32.exe	85
PID 2420 wrote to memory of 2488	2420	rundll32.exe	85
PID 2488 wrote to memory of 3344	2488	net.exe	87
PID 2488 wrote to memory of 3344	2488	net.exe	87
PID 2488 wrote to memory of 3344	2488	net.exe	87
PID 2420 wrote to memory of 3780	2420	rundll32.exe	88
PID 2420 wrote to memory of 3780	2420	rundll32.exe	88
PID 2420 wrote to memory of 3780	2420	rundll32.exe	88
PID 3780 wrote to memory of 4864	3780	net.exe	90
PID 3780 wrote to memory of 4864	3780	net.exe	90
PID 3780 wrote to memory of 4864	3780	net.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8a80469a2297ae5466b121a6641282f014d711729362f758e47f223d83980aa9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8a80469a2297ae5466b121a6641282f014d711729362f758e47f223d83980aa9.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2420
- - C:\Windows\SysWOW64\net.exe
    net stop winss
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2488
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop winss
      4⤵
      PID:3344
- - C:\Windows\SysWOW64\net.exe
    net stop OcHealthMon
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3780
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop OcHealthMon
      4⤵
      PID:4864

memory/2420-135-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download