dee64853dd83cd7cc7275509491b0e56bc1f7a82dfd52bf8a3a517a5b24dba03

Analysis

max time kernel
151s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 12:04

Target

dee64853dd83cd7cc7275509491b0e56bc1f7a82dfd52bf8a3a517a5b24dba03.dll
Size

151KB
MD5

3e02a9a90b01692c2881c527358c0cce
SHA1

5a098b2ec71e278ef12ff47630d00b76efe920af
SHA256

dee64853dd83cd7cc7275509491b0e56bc1f7a82dfd52bf8a3a517a5b24dba03
SHA512

dc2b60059d2abb427a4475cf8a8fc59ce7787b92582b1327162a41332a79b3ec3e3cf2e828c144bb03ce1ae146749325b918c0fe75bc07d69e3a290bdafa7940
SSDEEP

1536:kIsIwXI2IuIJkuvfZ/AuwtICVmG04D6OFcK5vcZSFCtluRZwZxUSTP:k7ZFNyxvfGx04iK5yyZox

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 1620	1416	rundll32.exe	82
PID 1416 wrote to memory of 1620	1416	rundll32.exe	82
PID 1416 wrote to memory of 1620	1416	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dee64853dd83cd7cc7275509491b0e56bc1f7a82dfd52bf8a3a517a5b24dba03.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dee64853dd83cd7cc7275509491b0e56bc1f7a82dfd52bf8a3a517a5b24dba03.dll,#1
  2⤵
  PID:1620

memory/1620-133-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download