33ca05dbfa3b15c542491cdc4194cf54c2b680903faf3a332649a055fd791e16

Analysis

max time kernel
60s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 05:50

Target

33ca05dbfa3b15c542491cdc4194cf54c2b680903faf3a332649a055fd791e16.dll
Size

153KB
MD5

2fabd98dd395a110463689e46bc2da60
SHA1

23eb2f78eb704eee7ad37fa25bf68b10eb0353eb
SHA256

33ca05dbfa3b15c542491cdc4194cf54c2b680903faf3a332649a055fd791e16
SHA512

aa02e09e04cedcdfa17d275fcf24910ff8b7c0ad13b99ea631b5c3e29b1a67d21dd4697b1d5b72542797f98657421703e66915908051b4c134b8e8720e5207b1
SSDEEP

3072:faaSyxvfGmwOVeX3kT+TycVQ9uB0oCuNQT9W:faaSQfvw3UW0oC9T9

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3668 wrote to memory of 3540	3668	rundll32.exe	83
PID 3668 wrote to memory of 3540	3668	rundll32.exe	83
PID 3668 wrote to memory of 3540	3668	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\33ca05dbfa3b15c542491cdc4194cf54c2b680903faf3a332649a055fd791e16.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3668
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\33ca05dbfa3b15c542491cdc4194cf54c2b680903faf3a332649a055fd791e16.dll,#1
  2⤵
  PID:3540

memory/3540-133-0x0000000010000000-0x0000000010033000-memory.dmp

Filesize
204KB

Download