a203a0bcd4d61f91db2c5b4fff4034fc34d198b7e0237b30e564b1bbf7149fd9

Analysis

max time kernel
171s
max time network
199s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 01:09

Target

a203a0bcd4d61f91db2c5b4fff4034fc34d198b7e0237b30e564b1bbf7149fd9.dll
Size

120KB
MD5

639e85c0fb705c57a1701b4db6d831e0
SHA1

d9b56de6a37d207a6af2a51256b91e770ab33729
SHA256

a203a0bcd4d61f91db2c5b4fff4034fc34d198b7e0237b30e564b1bbf7149fd9
SHA512

7b772ece6294964ef2b778a9b2fe5f6a19d1f5ce5c0dc31d0c312350cf9b957ddba2ed571ccb9c144f228fd5847a4670d95868a3a2a49b6db7ec91a00e5fbe40
SSDEEP

768:TdYZgFNCFD/XfScRlRJ7Dir/dOlBwK7iAlp3xix78ivYvaAy6kPC:54gPGWczjPOOlBw+lpBX1d

Score

1^/10

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
648	Process not Found

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3428 wrote to memory of 1084	3428	rundll32.exe	83
PID 3428 wrote to memory of 1084	3428	rundll32.exe	83
PID 3428 wrote to memory of 1084	3428	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a203a0bcd4d61f91db2c5b4fff4034fc34d198b7e0237b30e564b1bbf7149fd9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3428
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a203a0bcd4d61f91db2c5b4fff4034fc34d198b7e0237b30e564b1bbf7149fd9.dll,#1
  2⤵
  PID:1084

memory/1084-133-0x0000000025000000-0x000000002501E000-memory.dmp

Filesize
120KB

Download