99b89003de2690169187afae23de8144f932fe0b1dfc64b5f5e1b1a2b6610eba

Analysis

max time kernel
90s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 14:52

Target

99b89003de2690169187afae23de8144f932fe0b1dfc64b5f5e1b1a2b6610eba.dll
Size

26KB
MD5

03351d647751e186c7e695e72affbdd2
SHA1

a1fb84df0fb29cd0b99454e6f21a98444a7dccbc
SHA256

99b89003de2690169187afae23de8144f932fe0b1dfc64b5f5e1b1a2b6610eba
SHA512

21e899863f9860818d10b525bbb557763c4cdcffbdff7576cc7af099d6c31a12edeba89a44858c964ba22c6f15177ee027db90bc4b252944123775b2012a3db9
SSDEEP

384:I+ERmc8QDnRGNZll0cRCJXEt/LgnWE7dZxFdzkuq//x2hFiqI0ooNG8XRZdd:Omc8aniZo8jGD7dH2sVnXRZdd

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 2524	1692	rundll32.exe	80
PID 1692 wrote to memory of 2524	1692	rundll32.exe	80
PID 1692 wrote to memory of 2524	1692	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\99b89003de2690169187afae23de8144f932fe0b1dfc64b5f5e1b1a2b6610eba.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\99b89003de2690169187afae23de8144f932fe0b1dfc64b5f5e1b1a2b6610eba.dll,#1
  2⤵
  PID:2524

memory/2524-133-0x00000000752C0000-0x00000000752D1000-memory.dmp

Filesize
68KB

Download