1f4ffb36d995fe5ba9f7fe959644876b79ae2d125f1b8649b26f2892a9b69250

Analysis

max time kernel
144s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 06:20

Target

1f4ffb36d995fe5ba9f7fe959644876b79ae2d125f1b8649b26f2892a9b69250.dll
Size

164KB
MD5

56f9fb31832f024551e29c77bdddd0e0
SHA1

78f40c26d96fe491a42565dd4e4e19232d2a4deb
SHA256

1f4ffb36d995fe5ba9f7fe959644876b79ae2d125f1b8649b26f2892a9b69250
SHA512

c0d9a84c0809a5127d991e99d395b2596e017a05225380b2dfa488000939327ff5115a2c502787dc8e7aa59b9554e492b99655c99df923e72a654d8a0fdf9cbc
SSDEEP

1536:CEzUI8MIFIJkuvfZ/Auwk1XhsJetpV21RmUnApDNVB6/GN3pc+TWi9XqEzl5Klt9:k+SyxvfGkXshApw/d23ItW4

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 4848	4800	rundll32.exe	80
PID 4800 wrote to memory of 4848	4800	rundll32.exe	80
PID 4800 wrote to memory of 4848	4800	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1f4ffb36d995fe5ba9f7fe959644876b79ae2d125f1b8649b26f2892a9b69250.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1f4ffb36d995fe5ba9f7fe959644876b79ae2d125f1b8649b26f2892a9b69250.dll,#1
  2⤵
  PID:4848

memory/4848-132-0x0000000000000000-mapping.dmp

Download
memory/4848-133-0x0000000010000000-0x000000001002E000-memory.dmp

Filesize
184KB

Download