d793cde87ebab5c56781a4969218e3d600d01638d1a34629515534189abf0c8c

Analysis

max time kernel
147s
max time network
177s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 11:27

Target

d793cde87ebab5c56781a4969218e3d600d01638d1a34629515534189abf0c8c.dll
Size

275KB
MD5

4bbb3ec728616892be40fe43f34ea281
SHA1

8b011bb074fa6981de18a00ce55433d81ea1c921
SHA256

d793cde87ebab5c56781a4969218e3d600d01638d1a34629515534189abf0c8c
SHA512

5ce8183b897ab5c7cfd709ace8e72880a437f641d26a6bafbab0639cfd6a72e45c36eb3f0fd8bc7ab1680f32f6bd06ae28377260fc7486d4741084253c41e343
SSDEEP

6144:IdF0CcZGMEOAyp8Y9uZ6IyNoGb7OhU6UO4yXnDdxD6qGKWr4PxQZDFZ:fZeKkvUXyXBMFrexe

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3276 wrote to memory of 3496	3276	rundll32.exe	83
PID 3276 wrote to memory of 3496	3276	rundll32.exe	83
PID 3276 wrote to memory of 3496	3276	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d793cde87ebab5c56781a4969218e3d600d01638d1a34629515534189abf0c8c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3276
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d793cde87ebab5c56781a4969218e3d600d01638d1a34629515534189abf0c8c.dll,#1
  2⤵
  PID:3496

memory/3496-132-0x0000000000000000-mapping.dmp

Download
memory/3496-133-0x0000000074D40000-0x0000000074D88000-memory.dmp

Filesize
288KB

Download
memory/3496-134-0x00000000020B0000-0x00000000020D5000-memory.dmp

Filesize
148KB

Download