893e8d7d99df24d744e40f96c911f5d2066ff009ec4dfe55546f3c0db1753500

Analysis

max time kernel
176s
max time network
189s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 09:17

Target

893e8d7d99df24d744e40f96c911f5d2066ff009ec4dfe55546f3c0db1753500.dll
Size

15KB
MD5

866fa13157b29c02e4eb5947496a1c00
SHA1

a359bade8767015a1d6093919e9cb8584702e64e
SHA256

893e8d7d99df24d744e40f96c911f5d2066ff009ec4dfe55546f3c0db1753500
SHA512

1a84ac16adc6dc6cecfc75c0259fb3eaf0b9521a144e682ea3f6e78d11786e3ab83218b3fbe0f7491b7d6a7ccccc59dc72f17723703666fc7673b89316700456
SSDEEP

384:BIvnxs64eCC+q3kGlhAoNJJn5fNPWGM7xKhAzAp:K5geCG3xlhAoNJJWGMdKezA

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 572 wrote to memory of 228	572	rundll32.exe	83
PID 572 wrote to memory of 228	572	rundll32.exe	83
PID 572 wrote to memory of 228	572	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\893e8d7d99df24d744e40f96c911f5d2066ff009ec4dfe55546f3c0db1753500.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:572
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\893e8d7d99df24d744e40f96c911f5d2066ff009ec4dfe55546f3c0db1753500.dll,#1
  2⤵
  PID:228

memory/228-132-0x0000000000000000-mapping.dmp

Download
memory/228-133-0x0000000075200000-0x000000007520D000-memory.dmp

Filesize
52KB

Download