d0f2e2ebebb045650b6dc3d5ff21857d542d610c3c0676ec8e90c5598c76461c

Analysis

max time kernel
273s
max time network
295s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 04:20

Target

d0f2e2ebebb045650b6dc3d5ff21857d542d610c3c0676ec8e90c5598c76461c.dll
Size

162KB
MD5

65ccdf17d8b3f47c2035e7ad32c5a530
SHA1

b281bbc6e259cdc8eb2ee0cd401beec01621a24c
SHA256

d0f2e2ebebb045650b6dc3d5ff21857d542d610c3c0676ec8e90c5598c76461c
SHA512

f220a748b397e0a83c09a3cbf589c686ab89cafc6f7dcb54bdb8da452b0cca666c1908d139265b7a8931a0065d192d620d23ec94846d63106fc628c0b2f20477
SSDEEP

3072:a42tGP8HInPLHeknE7BC8I7aN4zt8LRsvUC:a8LHAA8SfOLRsvUC

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 4804	4600	rundll32.exe	81
PID 4600 wrote to memory of 4804	4600	rundll32.exe	81
PID 4600 wrote to memory of 4804	4600	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d0f2e2ebebb045650b6dc3d5ff21857d542d610c3c0676ec8e90c5598c76461c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d0f2e2ebebb045650b6dc3d5ff21857d542d610c3c0676ec8e90c5598c76461c.dll,#1
  2⤵
  PID:4804

memory/4804-133-0x0000000000761000-0x0000000000764000-memory.dmp

Filesize
12KB

Download