ad4d15220415a26a86d449bea514faf802b70554ff3577e6e9115c164534209b

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 23:48

Target

ad4d15220415a26a86d449bea514faf802b70554ff3577e6e9115c164534209b.dll
Size

85KB
MD5

412c75d167df7e685351426208d728c6
SHA1

6bbcab33d4426d5d0281bcd4b27c04b9e480ed6c
SHA256

ad4d15220415a26a86d449bea514faf802b70554ff3577e6e9115c164534209b
SHA512

5916f22b4d521e8437f78431de153ed6f4a2a57a28579bf8145ea1125bca9fd9598519f5b08ddd5ed92821997232541e141f6a4d7de0b956380fcc7a1f6d8638
SSDEEP

1536:Kz9eMFttJVexWngWCvvRXXWYF4qpTPJ7taa3tdWx23HJMCLg6MAxYmImp2H7fjaT:SrIECdRCMTPJ7NdWx2XJM9XKIJ7fjpmN

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 3884	1224	rundll32.exe	79
PID 1224 wrote to memory of 3884	1224	rundll32.exe	79
PID 1224 wrote to memory of 3884	1224	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ad4d15220415a26a86d449bea514faf802b70554ff3577e6e9115c164534209b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ad4d15220415a26a86d449bea514faf802b70554ff3577e6e9115c164534209b.dll,#1
  2⤵
  PID:3884

memory/3884-133-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download