ce15002472a26b2496a0a575f25f3807147f00d0ff14070edbe4c84a4b37be31

Analysis

max time kernel
92s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 17:14

Target

ce15002472a26b2496a0a575f25f3807147f00d0ff14070edbe4c84a4b37be31.dll
Size

88KB
MD5

c6c77a513e3c77746b6990ffd8f18aab
SHA1

17221161d223a3c1583fbbdff1e8823762421da5
SHA256

ce15002472a26b2496a0a575f25f3807147f00d0ff14070edbe4c84a4b37be31
SHA512

a0d1990f5beb18812ff3432764d7f60dcaf7c54a918b3ec3d1536e818dcfdc5ff85607b80f088e3f4e4d02caf9b94f203c259ae49eb39961b625bd7b6a976b07
SSDEEP

1536:BF2Xu/iK8paDwkbIl4p+cwFonOEitRz71N3OkBVxQDWPTXz/Y:BF2e/WEbucwwOEivzBNekBVxAWzzY

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 2460	1632	rundll32.exe	78
PID 1632 wrote to memory of 2460	1632	rundll32.exe	78
PID 1632 wrote to memory of 2460	1632	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce15002472a26b2496a0a575f25f3807147f00d0ff14070edbe4c84a4b37be31.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce15002472a26b2496a0a575f25f3807147f00d0ff14070edbe4c84a4b37be31.dll,#1
  2⤵
  PID:2460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2460 -ip 2460
1⤵
PID:4912

memory/2460-133-0x000000001FF70000-0x000000001FFD2000-memory.dmp

Filesize
392KB

Download
memory/2460-134-0x000000001FF70000-0x000000001FFD2000-memory.dmp

Filesize
392KB

Download