f37944b97d05b9432adb10ce21283161edeb5d0953519fa8ce5cd8d874be6a47

Analysis

max time kernel
92s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 11:16

Target

f37944b97d05b9432adb10ce21283161edeb5d0953519fa8ce5cd8d874be6a47.dll
Size

12KB
MD5

71ad82e89d4b6917b2a29b24dce2ed10
SHA1

58844553fbb366c37540c6a2d5b6dfe73568993c
SHA256

f37944b97d05b9432adb10ce21283161edeb5d0953519fa8ce5cd8d874be6a47
SHA512

07351a419acfc152f3a7f8b814b0346e82b60b1004a5432f65aa5fec454cb1bc0daba14e971ee1eb81ab4d8f543df970af70a0823f44d856be66e74cba033b6c
SSDEEP

192:WiAo/d/ftODI5bLwlkljKWDWupfielRrMpwabuKW+4DtyQ:WfGpff5b0lkdKWDWupfielRrM7bhW+4/

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4432 wrote to memory of 4332	4432	rundll32.exe	76
PID 4432 wrote to memory of 4332	4432	rundll32.exe	76
PID 4432 wrote to memory of 4332	4432	rundll32.exe	76

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f37944b97d05b9432adb10ce21283161edeb5d0953519fa8ce5cd8d874be6a47.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4432
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f37944b97d05b9432adb10ce21283161edeb5d0953519fa8ce5cd8d874be6a47.dll,#1
  2⤵
  PID:4332

memory/4332-133-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/4332-134-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download