000beaf1e979ea166d9f3d0848bf42ced4049609f53644ead33269fac1db5a7b

Analysis

max time kernel
91s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 11:31

Target

000beaf1e979ea166d9f3d0848bf42ced4049609f53644ead33269fac1db5a7b.dll
Size

336KB
MD5

9edbb84cad826eee2356559b5a0279a0
SHA1

02bf6a4c6984feaa6999b402030f33bd677c29ae
SHA256

000beaf1e979ea166d9f3d0848bf42ced4049609f53644ead33269fac1db5a7b
SHA512

82130e014d6cfa0aede8822bc40b25ead66feb23b96f0a521dc839259aeea45eb8113de7a7b98567619caaf2a9df9c8dddd4a4f6482bd83bcadaa2747b3e33e8
SSDEEP

3072:vDATTZsMl8/5ASsFJA93YnXFMsRnEr91ZJecT/xp2Sr9BzbWNNw:vDq1Hl25A3uYbnEJ1icT/rHZNWNN

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3376 wrote to memory of 1016	3376	rundll32.exe	80
PID 3376 wrote to memory of 1016	3376	rundll32.exe	80
PID 3376 wrote to memory of 1016	3376	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\000beaf1e979ea166d9f3d0848bf42ced4049609f53644ead33269fac1db5a7b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3376
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\000beaf1e979ea166d9f3d0848bf42ced4049609f53644ead33269fac1db5a7b.dll,#1
  2⤵
  PID:1016

memory/1016-132-0x0000000000000000-mapping.dmp

Download
memory/1016-133-0x000000005E740000-0x000000005E797000-memory.dmp

Filesize
348KB

Download
memory/1016-134-0x0000000000840000-0x0000000000845000-memory.dmp

Filesize
20KB

Download