ca6886caa69a74877225b348bdc7f8d3ecca3813bf714723a37661e741df2861

Analysis

max time kernel
187s
max time network
196s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 17:42

Target

ca6886caa69a74877225b348bdc7f8d3ecca3813bf714723a37661e741df2861.dll
Size

165KB
MD5

9852dbd875e4482426acd9484b639618
SHA1

3149e5394a469cb8061094ce182a2215498d32bb
SHA256

ca6886caa69a74877225b348bdc7f8d3ecca3813bf714723a37661e741df2861
SHA512

710586f3419e15b7dacfea4deb164be11306419bbfcf992744a47c2bfa4b44bf334f247d2359a0739e2dc8d6d45c4fd2b1fa7a1deebd79a258816ea0dc41eb15
SSDEEP

3072:64Tc8xvfGCNEe6fwSWVA7iY8KH1TWGm1A7rmADH1TG:1Tc+fNNEHL

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4244 wrote to memory of 5020	4244	rundll32.exe	79
PID 4244 wrote to memory of 5020	4244	rundll32.exe	79
PID 4244 wrote to memory of 5020	4244	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ca6886caa69a74877225b348bdc7f8d3ecca3813bf714723a37661e741df2861.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4244
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ca6886caa69a74877225b348bdc7f8d3ecca3813bf714723a37661e741df2861.dll,#1
  2⤵
  PID:5020

memory/5020-133-0x0000000010000000-0x000000001002C000-memory.dmp

Filesize
176KB

Download