ba5a98ad273e199148e6adada96598663aaeffeb31befc7d2aa0643ffac0e07f

Analysis

max time kernel
176s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 17:30

Target

ba5a98ad273e199148e6adada96598663aaeffeb31befc7d2aa0643ffac0e07f.dll
Size

831KB
MD5

7d793e6b1a8bd9e37c482292404ae300
SHA1

61e67acdc7bc28084a938c83f3d38d758469bfe5
SHA256

ba5a98ad273e199148e6adada96598663aaeffeb31befc7d2aa0643ffac0e07f
SHA512

b94235e5b9da5895ed3d136a6371bee6e1c6455dcb169c89fe1a21933f13c52f233f36e65f65cc1aba436eb083b5bce8f46dc781519a7eab557a129a2584f3a5
SSDEEP

12288:7+m7dhwDrl/L9D0Bw1b31jupcFvLwdqRUBgS/nYvqCJpwTlTPQG888888888888B:NA5/L9D0Bw1b31tvzCBgSvYvqJTlE

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5072 wrote to memory of 1808	5072	rundll32.exe	82
PID 5072 wrote to memory of 1808	5072	rundll32.exe	82
PID 5072 wrote to memory of 1808	5072	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ba5a98ad273e199148e6adada96598663aaeffeb31befc7d2aa0643ffac0e07f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ba5a98ad273e199148e6adada96598663aaeffeb31befc7d2aa0643ffac0e07f.dll,#1
  2⤵
  PID:1808

memory/1808-133-0x0000000002DA0000-0x0000000002E78000-memory.dmp

Filesize
864KB

Download