b3b2a4fc34d5f567350106a3db9da564641b15dbe5169d12d0466e6d2ff4cb17

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 13:18

Target

b3b2a4fc34d5f567350106a3db9da564641b15dbe5169d12d0466e6d2ff4cb17.dll
Size

21KB
MD5

0f83b2c00ef5dc3badc1acaeb8319a90
SHA1

9e1b422d9a1e21365a6125fcfe1605a82d4e95d5
SHA256

b3b2a4fc34d5f567350106a3db9da564641b15dbe5169d12d0466e6d2ff4cb17
SHA512

7b5b6d05d7b22163cf302209a07b8555e93217bd3d7b2c68f8ad2330105324f2df70c64c657fa91bc47a843169f318ffbded94ef18bf01fbc53a4d03f76ee40e
SSDEEP

384:CR8B2rSCE6puPi3wt5LmDN1/YvgD7kJ2+Pma6aOn9HBfAZv7Wn:CRg2A6ga3pDXogvy2ra6a7W

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4308 wrote to memory of 5024	4308	rundll32.exe	81
PID 4308 wrote to memory of 5024	4308	rundll32.exe	81
PID 4308 wrote to memory of 5024	4308	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b3b2a4fc34d5f567350106a3db9da564641b15dbe5169d12d0466e6d2ff4cb17.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4308
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b3b2a4fc34d5f567350106a3db9da564641b15dbe5169d12d0466e6d2ff4cb17.dll,#1
  2⤵
  PID:5024

memory/5024-133-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/5024-134-0x00000000009E0000-0x00000000009F0000-memory.dmp

Filesize
64KB

Download
memory/5024-135-0x00000000009E0000-0x00000000009F0000-memory.dmp

Filesize
64KB

Download