bc95f819ce8d298e84107f4bd068b8d4dd6e2460b72d772f2e2bb8644da9d5d2

Analysis

max time kernel
251s
max time network
308s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 14:10

Target

bc95f819ce8d298e84107f4bd068b8d4dd6e2460b72d772f2e2bb8644da9d5d2.dll
Size

78KB
MD5

57c917754a60135b963347f45a732d00
SHA1

4004c843f4d1b57bd02bfcdc33c30d71c0587d97
SHA256

bc95f819ce8d298e84107f4bd068b8d4dd6e2460b72d772f2e2bb8644da9d5d2
SHA512

2cf6ef95cb0367c96b7813d934e63487ba652ab71f2c3b57155e811bff044f7ff415259eb10a2a8fc3f105f8c1cab047cfb100421c7396a2812301b2089cf061
SSDEEP

1536:8tRz1yUW5C/jC+VqVpNYz9+bt6JYpM6QRSSdmFMhl/lpJSel5lS7DdmFUL4:YLrMTx6GpAndmF8tDJfl+vddE

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 4748	2364	rundll32.exe	80
PID 2364 wrote to memory of 4748	2364	rundll32.exe	80
PID 2364 wrote to memory of 4748	2364	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bc95f819ce8d298e84107f4bd068b8d4dd6e2460b72d772f2e2bb8644da9d5d2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bc95f819ce8d298e84107f4bd068b8d4dd6e2460b72d772f2e2bb8644da9d5d2.dll,#1
  2⤵
  PID:4748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4748 -ip 4748
1⤵
PID:2204

memory/4748-133-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download