bc87f010538d13ca91d82e608ea7554ceb19e0cec9daa8c51afcd2a2704c3051

Analysis

max time kernel
170s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 03:21

Target

bc87f010538d13ca91d82e608ea7554ceb19e0cec9daa8c51afcd2a2704c3051.dll
Size

73KB
MD5

61fdfd41f537e81cd0a6bdbf0abfac2f
SHA1

4e1b057518548182a9c58cb5592f0b14cd526be8
SHA256

bc87f010538d13ca91d82e608ea7554ceb19e0cec9daa8c51afcd2a2704c3051
SHA512

9f6c2a915dac04c3ccc9feeef6e5bf107bdb52da1ea18ea3aace973e08ecc052ed70e6f2958e1e6a0b75928a0119d4409101a65e35b18f59f3dd8acf937d9dcb
SSDEEP

1536:IykzkagfZsew6GiUcWjmCyGUwUSg9CZZ0XFJRu0Pbq:IFzkaeAyUcWjmCy6OCZ+bbq

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4560 wrote to memory of 4200	4560	rundll32.exe	82
PID 4560 wrote to memory of 4200	4560	rundll32.exe	82
PID 4560 wrote to memory of 4200	4560	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bc87f010538d13ca91d82e608ea7554ceb19e0cec9daa8c51afcd2a2704c3051.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bc87f010538d13ca91d82e608ea7554ceb19e0cec9daa8c51afcd2a2704c3051.dll,#1
  2⤵
  PID:4200

memory/4200-133-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download