4b0c49b1dae6363b2d20f1d2b1069cd42bffdc7885f90b88a2a98b508712969d

Analysis

max time kernel
113s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 05:20

Target

4b0c49b1dae6363b2d20f1d2b1069cd42bffdc7885f90b88a2a98b508712969d.dll
Size

44KB
MD5

6d78282773ecefcbe34c39e0b63b3cd0
SHA1

1ca700ad492e7e6dabd4b960145ad897b0a133db
SHA256

4b0c49b1dae6363b2d20f1d2b1069cd42bffdc7885f90b88a2a98b508712969d
SHA512

058dc5ea554de6e969ecf6a956f3fce1d607f661302e352fcac9ffae1c5d7ff213b95e00cc2dc82db9370e64cb5d3e442278d45b38d696d5da124252e6dbaf1b
SSDEEP

768:XOUy+AUbpolKYsGzGfyP2ocvXkWN/7o91QQjlb:HFbpolcG6xdZlo91QQhb

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 800 wrote to memory of 1364	800	rundll32.exe	78
PID 800 wrote to memory of 1364	800	rundll32.exe	78
PID 800 wrote to memory of 1364	800	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4b0c49b1dae6363b2d20f1d2b1069cd42bffdc7885f90b88a2a98b508712969d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:800
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4b0c49b1dae6363b2d20f1d2b1069cd42bffdc7885f90b88a2a98b508712969d.dll,#1
  2⤵
  PID:1364

memory/1364-132-0x0000000000000000-mapping.dmp

Download
memory/1364-133-0x0000000010000000-0x000000001000B000-memory.dmp

Filesize
44KB

Download