eed19deb1ef05e73e35367828cf3275d200e8c2389012468b2736d90eaa99ddf

Analysis

max time kernel
91s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04-12-2022 01:47

Target

eed19deb1ef05e73e35367828cf3275d200e8c2389012468b2736d90eaa99ddf.dll
Size

472KB
MD5

038a60586e1e0e0f3a08bcc4be8b7640
SHA1

a53b7bd1c7bfe3b6bc2dcae3c93ff9009826e0be
SHA256

eed19deb1ef05e73e35367828cf3275d200e8c2389012468b2736d90eaa99ddf
SHA512

d93921a5c9b3ac5df25b9b40b7a19839518ddca29ebb23893df891c0a294bcd56bbfda219dd22cb9d2718c0e5a615baf1de67abd6457887c7a396cca00122e02
SSDEEP

6144:43yOgvjAL00qj6GCGKF7hJ1q9UGaC5s48aMaNsWCyD/Vfy246j2Qk3YBZxkWXh:HvjALU6Go7hJ1q9U1aMaNsQciFkWXh

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5036 wrote to memory of 1144	5036	rundll32.exe	81
PID 5036 wrote to memory of 1144	5036	rundll32.exe	81
PID 5036 wrote to memory of 1144	5036	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\eed19deb1ef05e73e35367828cf3275d200e8c2389012468b2736d90eaa99ddf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\eed19deb1ef05e73e35367828cf3275d200e8c2389012468b2736d90eaa99ddf.dll,#1
  2⤵
  PID:1144

memory/1144-132-0x0000000000000000-mapping.dmp

Download
memory/1144-133-0x0000000061CE0000-0x0000000061D58000-memory.dmp

Filesize
480KB

Download