0b5f24d5bfe387b4797521b0ad6545f031004be7f749dd25ad4d5aa18d67bbac

Analysis

max time kernel
179s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02-12-2022 20:44

Target

0b5f24d5bfe387b4797521b0ad6545f031004be7f749dd25ad4d5aa18d67bbac.dll
Size

257KB
MD5

78177adb160f4736036bd112e0636910
SHA1

1a0d729feb785b26ba712bc42b6dc44892afccb0
SHA256

0b5f24d5bfe387b4797521b0ad6545f031004be7f749dd25ad4d5aa18d67bbac
SHA512

c6d5075454e11587cfe04349f32d26319cf00fd0631f8fbdfdfe68895c5c318e632407051acf22ecec86bfb6b50a22ecf5771603617b5a341b22c44bd016d426
SSDEEP

3072:IXWAGrvnenIwFuAIgmGQd0OyRj+6EFfKwfD/QVNXtddSKqPPLFE:IXWAqaIwKFCwb0tdNqPPR

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4696 wrote to memory of 5056	4696	rundll32.exe	80
PID 4696 wrote to memory of 5056	4696	rundll32.exe	80
PID 4696 wrote to memory of 5056	4696	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0b5f24d5bfe387b4797521b0ad6545f031004be7f749dd25ad4d5aa18d67bbac.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4696
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0b5f24d5bfe387b4797521b0ad6545f031004be7f749dd25ad4d5aa18d67bbac.dll,#1
  2⤵
  PID:5056

memory/5056-132-0x0000000000000000-mapping.dmp

Download
memory/5056-133-0x0000000010000000-0x0000000010044000-memory.dmp

Filesize
272KB

Download