420bcc4a9ad6c3da06da8ce14a546166c948afc841c8e738441fbf1ab368d6b5

Analysis

max time kernel
90s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 05:33

Target

420bcc4a9ad6c3da06da8ce14a546166c948afc841c8e738441fbf1ab368d6b5.dll
Size

15KB
MD5

c16d52fbebba90d00b10fb3785d606d0
SHA1

81ea47aa43332c75c65ed48b9443dd701c5c6137
SHA256

420bcc4a9ad6c3da06da8ce14a546166c948afc841c8e738441fbf1ab368d6b5
SHA512

d1b9220c4bd3deda36a0ac0e552942d1bd545bed29b5ce1a09c465e486343577a4826e958ad332eb29896a446930c8d8d7dccf83da2367220b6215c9ff5661e4
SSDEEP

192:8Y31UWwiyT82mW8tg4F+RecdALXvoJE+tq1LVkq4MIk:8qUUyT82m7gu+RzdALXvoJoNVkVMI

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5068 wrote to memory of 4956	5068	rundll32.exe	81
PID 5068 wrote to memory of 4956	5068	rundll32.exe	81
PID 5068 wrote to memory of 4956	5068	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\420bcc4a9ad6c3da06da8ce14a546166c948afc841c8e738441fbf1ab368d6b5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5068
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\420bcc4a9ad6c3da06da8ce14a546166c948afc841c8e738441fbf1ab368d6b5.dll,#1
  2⤵
  PID:4956

memory/4956-133-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/4956-134-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download