181abbc8f866f09271186d5f61337af0730afe6e6112b70ef0b6b6bc2e450f28

Analysis

max time kernel
146s
max time network
194s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 20:13

Target

181abbc8f866f09271186d5f61337af0730afe6e6112b70ef0b6b6bc2e450f28.dll
Size

25KB
MD5

be7302b3810903f75cd5d4a27d68a220
SHA1

13cc52088e55b875694561048e46f8c3b254742f
SHA256

181abbc8f866f09271186d5f61337af0730afe6e6112b70ef0b6b6bc2e450f28
SHA512

c9c70b5a3e774c2c469c0e6867ccb8ee00c7eea17af72f6598d6d248e1e77d4fd6cf385e8375f1a9fb6445d57425de304db2d2c1bb3019f8fd18a0dec51910ff
SSDEEP

192:DdZipEjVYD7ORz803ivZQGFa6sqw4iiR0YSJR6+G+dnUGHbd3rbLyuIjeQwPd59H:DdZ+kKqRavZQGUOiS+9Cmblb+qJdb6a

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4376 wrote to memory of 1896	4376	rundll32.exe	82
PID 4376 wrote to memory of 1896	4376	rundll32.exe	82
PID 4376 wrote to memory of 1896	4376	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\181abbc8f866f09271186d5f61337af0730afe6e6112b70ef0b6b6bc2e450f28.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4376
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\181abbc8f866f09271186d5f61337af0730afe6e6112b70ef0b6b6bc2e450f28.dll,#1
  2⤵
  PID:1896

memory/1896-133-0x0000000010000000-0x000000001001A000-memory.dmp

Filesize
104KB

Download