874ad5f0cc02c73c73b5e02a969f6037e15b8a1311d3c4bb783565883a360358

Analysis

max time kernel
91s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 19:26

Target

874ad5f0cc02c73c73b5e02a969f6037e15b8a1311d3c4bb783565883a360358.dll
Size

53KB
MD5

a063d17c2dfca8841cc775a0171134e6
SHA1

b8e333cfcd541ba34267e58559cfc5e7bea7faf7
SHA256

874ad5f0cc02c73c73b5e02a969f6037e15b8a1311d3c4bb783565883a360358
SHA512

1a9c481da7caae82d0b4f8332b6618764ad7e722cf1946625ae267341e21396fe97291b684e4005b1c2f1e5599b3697c3bd83fbebc56acec113526bb651755ee
SSDEEP

1536:IykzkagnHXKjap5ob6JRSdkSClfWhRFgbK+76R:IFzkayHCURF0FgOt

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 4792	2836	rundll32.exe	81
PID 2836 wrote to memory of 4792	2836	rundll32.exe	81
PID 2836 wrote to memory of 4792	2836	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\874ad5f0cc02c73c73b5e02a969f6037e15b8a1311d3c4bb783565883a360358.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\874ad5f0cc02c73c73b5e02a969f6037e15b8a1311d3c4bb783565883a360358.dll,#1
  2⤵
  PID:4792

memory/4792-133-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download