96c4b2d9130a62ac615556faf05a9837d9521836305ae47b07124e3d2e9a8553

Analysis

max time kernel
144s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 01:27

Target

96c4b2d9130a62ac615556faf05a9837d9521836305ae47b07124e3d2e9a8553.dll
Size

134KB
MD5

f229d480987abf55fee0f9c772de4f20
SHA1

9fdb557d8d5a932b5f3772e50846646c630a1d09
SHA256

96c4b2d9130a62ac615556faf05a9837d9521836305ae47b07124e3d2e9a8553
SHA512

e6744aa84014066db3bfa60c8c05f69dc4526415de738dcdd76293ff55df15ea11e52547df614307ab0592122305eaffcb3acaf3db4e34a926b9562b6375b247
SSDEEP

1536:LsIuIJkuvfZ/AuwMQvQ+5hd3ebcLViUqSecVuYXKc6nuPK+vp2A0XQpedFPQVH04:4NyxvfG1IgfObdzJdc6nuPKSpxpWUP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 4252	2148	rundll32.exe	80
PID 2148 wrote to memory of 4252	2148	rundll32.exe	80
PID 2148 wrote to memory of 4252	2148	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\96c4b2d9130a62ac615556faf05a9837d9521836305ae47b07124e3d2e9a8553.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\96c4b2d9130a62ac615556faf05a9837d9521836305ae47b07124e3d2e9a8553.dll,#1
  2⤵
  PID:4252

memory/4252-133-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download