85a853ae5277b3df847f770f2ebec4e56539fa5f44bbfd7e335c0ba125131d6d

Analysis

max time kernel
153s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02-12-2022 20:59

Target

85a853ae5277b3df847f770f2ebec4e56539fa5f44bbfd7e335c0ba125131d6d.dll
Size

73KB
MD5

ddfa56ab2189a08cf4be7ceb60c00ae5
SHA1

5f9b5135f8141757eb7f5e79c339c9c9e021904d
SHA256

85a853ae5277b3df847f770f2ebec4e56539fa5f44bbfd7e335c0ba125131d6d
SHA512

e588e76d4022e5cfa8a1005a5066fa93a1aee1742384d28874b31305a63f06e277959767f0fe0f66730fa0537e23089ff5063a515ad1b998fb5f1e64db1fd195
SSDEEP

1536:pZIZqCTsWlG080IjesJMVxKOdNA2HqsH+hayXXpNI:QnTNlG08JjPGVRHRHmayXXpNI

Score

1^/10

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 720 wrote to memory of 4012	720	rundll32.exe	80
PID 720 wrote to memory of 4012	720	rundll32.exe	80
PID 720 wrote to memory of 4012	720	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\85a853ae5277b3df847f770f2ebec4e56539fa5f44bbfd7e335c0ba125131d6d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:720
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\85a853ae5277b3df847f770f2ebec4e56539fa5f44bbfd7e335c0ba125131d6d.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4012

memory/4012-133-0x0000000000470000-0x0000000000487000-memory.dmp

Filesize
92KB

Download