906ff27f63ccab7309f52eb1329c909e68f2900c3447a6b15117ad3114a45e54

Analysis

max time kernel
267s
max time network
400s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 23:48

Target

906ff27f63ccab7309f52eb1329c909e68f2900c3447a6b15117ad3114a45e54.dll
Size

162KB
MD5

c2278779418d30a057f52c030fe754f0
SHA1

8b3333c1bc3abd91b6ee8e2640852677340e5047
SHA256

906ff27f63ccab7309f52eb1329c909e68f2900c3447a6b15117ad3114a45e54
SHA512

ec2d557ceefefb6a99e99cf18ed75a9803be17a4babfe9e001f23fcabcda3ad1cdc52a1efff787c3ee985566158c426e4a8e3e49429fa50ac7803dd8ac88cdf8
SSDEEP

3072:ETL3VCQxJHVzlIQP9nfcmHsrQg78Bq3momZTuqtCW1xziMqqDa/0ueYqZFVC:ETLdf1TfsrQNY2oyUe1qqDG3l

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4736 wrote to memory of 1516	4736	rundll32.exe	81
PID 4736 wrote to memory of 1516	4736	rundll32.exe	81
PID 4736 wrote to memory of 1516	4736	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\906ff27f63ccab7309f52eb1329c909e68f2900c3447a6b15117ad3114a45e54.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\906ff27f63ccab7309f52eb1329c909e68f2900c3447a6b15117ad3114a45e54.dll,#1
  2⤵
  PID:1516

memory/1516-133-0x0000000000BE0000-0x0000000000C13000-memory.dmp

Filesize
204KB

Download