604ae4d98645b1c27833c3c72c43df60721f16de7244ea7385e97c536fefc16a

Analysis

max time kernel
112s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 04:04

Target

604ae4d98645b1c27833c3c72c43df60721f16de7244ea7385e97c536fefc16a.dll
Size

58KB
MD5

13e00d0fff6f2283aa161617649972c6
SHA1

372b6dbde79a856eb9cd2ed78bb60aee3757bf8f
SHA256

604ae4d98645b1c27833c3c72c43df60721f16de7244ea7385e97c536fefc16a
SHA512

9a6af19d7482d9fc19e887e3364857ea9f050a8a2b81df5500dbbcab8b2796df5361af6eabbb72d3e51994625de3c08078386fc8c8753a13f644450537ca4404
SSDEEP

768:C9pMYl5zOpJvErq9wUgT1Z24BalWVUlBv93cF0mRUbpCwUTvCYDzjgdKCCzVDIud:CoKopJBA1M4V0BJcCmReOT6YDzkdj2b

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4956 wrote to memory of 4832	4956	rundll32.exe	82
PID 4956 wrote to memory of 4832	4956	rundll32.exe	82
PID 4956 wrote to memory of 4832	4956	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\604ae4d98645b1c27833c3c72c43df60721f16de7244ea7385e97c536fefc16a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4956
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\604ae4d98645b1c27833c3c72c43df60721f16de7244ea7385e97c536fefc16a.dll,#1
  2⤵
  PID:4832

memory/4832-135-0x0000000000000000-mapping.dmp

Download
memory/4832-136-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download