b04926d8d49eb1fb521e3b49bf5a884738fe7ed9c055941b5e1d8992a1b9259a

Analysis

max time kernel
136s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 02:00

Target

b04926d8d49eb1fb521e3b49bf5a884738fe7ed9c055941b5e1d8992a1b9259a.dll
Size

201KB
MD5

a0fd72013cc361925c057a20d8123150
SHA1

73f48eb9a02b08a5ecbb645257cb0835bfefb40c
SHA256

b04926d8d49eb1fb521e3b49bf5a884738fe7ed9c055941b5e1d8992a1b9259a
SHA512

bf524f8dc771c0df030df38b606a64cf354e73a450a7ea23ce8d556c90e39870d8af874c76b5a7d680d0af5d3a10457cd8429628a43e1d995bf6579fbd0671e1
SSDEEP

3072:QDSOgHMsg8IkQQLkO8nrIDQOt8FBBroj2ErQ1FcJ/BWAwsr:vOgHPg8I68it8FBabQ1FcnWAwsr

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4984 wrote to memory of 5092	4984	rundll32.exe	83
PID 4984 wrote to memory of 5092	4984	rundll32.exe	83
PID 4984 wrote to memory of 5092	4984	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b04926d8d49eb1fb521e3b49bf5a884738fe7ed9c055941b5e1d8992a1b9259a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4984
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b04926d8d49eb1fb521e3b49bf5a884738fe7ed9c055941b5e1d8992a1b9259a.dll,#1
  2⤵
  PID:5092

memory/5092-133-0x0000000010000000-0x0000000010036000-memory.dmp

Filesize
216KB

Download