969a3ecee82c2efc5e9daa01a73e6e65573658631c1def7de83ded4a92043416

Analysis

max time kernel
91s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 16:56

Target

969a3ecee82c2efc5e9daa01a73e6e65573658631c1def7de83ded4a92043416.dll
Size

174KB
MD5

f6a6df7cec893ded29526404027f7174
SHA1

95600d8ad8595c871e387c98fad1cedb90996c75
SHA256

969a3ecee82c2efc5e9daa01a73e6e65573658631c1def7de83ded4a92043416
SHA512

08d0ca4e48b04b99e06f90b41e16bd9d4ac559aead21d3a03f10f7c478934050640afa8345ac098a7bc3f66e034bb7bb24da16ee00e17e32a3b1d47fbd3c790a
SSDEEP

1536:5I5YITIJkuvfZ/AuwmwMZKIssZacysD3CdXANjOzme6ilXb0mQWyyefFfxgCPlN4:5VYaxvfGxyKIcc53fNjOzmeFpk1PlN4

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3464 wrote to memory of 3592	3464	rundll32.exe	80
PID 3464 wrote to memory of 3592	3464	rundll32.exe	80
PID 3464 wrote to memory of 3592	3464	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\969a3ecee82c2efc5e9daa01a73e6e65573658631c1def7de83ded4a92043416.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3464
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\969a3ecee82c2efc5e9daa01a73e6e65573658631c1def7de83ded4a92043416.dll,#1
  2⤵
  PID:3592

memory/3592-133-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download