091381a836ccb21deaa9a059830712237886785cdd5fdcdfb3e0d22f153cfbd6

Analysis

max time kernel
146s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 20:42

Target

091381a836ccb21deaa9a059830712237886785cdd5fdcdfb3e0d22f153cfbd6.dll
Size

255KB
MD5

7ea96120bb6a3c405c335aa1812c6ec0
SHA1

3660a4d2dbb699e75278b15b46b074066d471071
SHA256

091381a836ccb21deaa9a059830712237886785cdd5fdcdfb3e0d22f153cfbd6
SHA512

b1bd68e48fbe05eff8439b3cdd2776a7946e35e773d80b15a08a149ecbb2ee0d0955f1282bbb6c826067ea8e35fc762c822efe25115aa8fb71c3661896cc05cb
SSDEEP

3072:tQZX4vr1VAw0AWfdN2AGTVyLi5ETDG642LD9gZoyJQkCtWPnOdX:tQZX4vrBPLRvQkKWP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 336 wrote to memory of 4488	336	rundll32.exe	81
PID 336 wrote to memory of 4488	336	rundll32.exe	81
PID 336 wrote to memory of 4488	336	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\091381a836ccb21deaa9a059830712237886785cdd5fdcdfb3e0d22f153cfbd6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:336
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\091381a836ccb21deaa9a059830712237886785cdd5fdcdfb3e0d22f153cfbd6.dll,#1
  2⤵
  PID:4488

memory/4488-133-0x0000000010000000-0x0000000010043000-memory.dmp

Filesize
268KB

Download