b0e8107f94d7cc9cbba5c21ecac8023243b3c79ccabb3979446d98b9b920e11a

Analysis

max time kernel
175s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 15:11

Target

b0e8107f94d7cc9cbba5c21ecac8023243b3c79ccabb3979446d98b9b920e11a.dll
Size

57KB
MD5

af35e20d573172559a69e3dff30a6d81
SHA1

d90b49abebfc83e8c516e8fb06659ba39065f1e9
SHA256

b0e8107f94d7cc9cbba5c21ecac8023243b3c79ccabb3979446d98b9b920e11a
SHA512

aafad7bde4075a874a65bb97d6387d6597896772cee21a9731c9af7203ef99ec45d74f8d741e37ffbb7effde4361689586988bc84f911097f622c5b866b725fd
SSDEEP

1536:0NIKD84YU6EMyDcqiZZZNihyISFIR6/JP+3CT:Jq84YU6ErtGNEKIpCT

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 4224	1748	rundll32.exe	83
PID 1748 wrote to memory of 4224	1748	rundll32.exe	83
PID 1748 wrote to memory of 4224	1748	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b0e8107f94d7cc9cbba5c21ecac8023243b3c79ccabb3979446d98b9b920e11a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b0e8107f94d7cc9cbba5c21ecac8023243b3c79ccabb3979446d98b9b920e11a.dll,#1
  2⤵
  PID:4224

memory/4224-133-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download