dd8ac17d186ac1abb3b413a7048de8bc8d76b97bed88100ab239f16a83171297

Analysis

max time kernel
148s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04-12-2022 01:05

Target

dd8ac17d186ac1abb3b413a7048de8bc8d76b97bed88100ab239f16a83171297.dll
Size

84KB
MD5

f89bccec2d793bf07bda77cbf9b9d190
SHA1

5918320f07b99ca7b2f3292b5e5a1403cf5599c0
SHA256

dd8ac17d186ac1abb3b413a7048de8bc8d76b97bed88100ab239f16a83171297
SHA512

085e66893a5f0db73f27130dbc7fe3db4ddc4d46a375c0a700bc1b7f05633e29d10c6f2cca0253a6d2261b2779d549d7fc0c95ba0e14a73dc546b4f2de25f77c
SSDEEP

1536:AAMCxhV0vxuF9W+UfA9dncXk38His8xu983g/vgSs:td0vsqfA9dn0k3q8xA83MvW

Score

8^/10

Blocklisted process makes network request 1 IoCs

flow	pid	Process
20	4808	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2584 wrote to memory of 4808	2584	rundll32.exe	82
PID 2584 wrote to memory of 4808	2584	rundll32.exe	82
PID 2584 wrote to memory of 4808	2584	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd8ac17d186ac1abb3b413a7048de8bc8d76b97bed88100ab239f16a83171297.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd8ac17d186ac1abb3b413a7048de8bc8d76b97bed88100ab239f16a83171297.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:4808

memory/4808-132-0x0000000000000000-mapping.dmp

Download
memory/4808-133-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download
memory/4808-134-0x0000000000700000-0x000000000070F000-memory.dmp

Filesize
60KB

Download
memory/4808-135-0x0000000000710000-0x000000000071F000-memory.dmp

Filesize
60KB

Download
memory/4808-136-0x0000000000710000-0x000000000071F000-memory.dmp

Filesize
60KB

Download