4cdd8c0e732dc1f6393fff99513421848f8721964a7f9dafa5781e051d4f25aa

Analysis

max time kernel
146s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04-12-2022 02:22

Target

4cdd8c0e732dc1f6393fff99513421848f8721964a7f9dafa5781e051d4f25aa.dll
Size

156KB
MD5

8238acef0e2a830eeacf2874efb0b910
SHA1

ee2f7c720be21b8ec03e1191a46b5bc9f0317f1b
SHA256

4cdd8c0e732dc1f6393fff99513421848f8721964a7f9dafa5781e051d4f25aa
SHA512

d37763fd9bf0a1acae947d978fe7680d907a0b7b2bc5179a53fdff3179bd8e12c0b4f51dd2b17e81a1f69b866342bc1974509bd9d1422916418e8f7e63a4734b
SSDEEP

3072:skHNwyLv/ENXtvW8mD4d0AxdRf4+lGevEW5i8xfcP:skH28hqtdxh3li8xfI

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4688 wrote to memory of 4732	4688	rundll32.exe	78
PID 4688 wrote to memory of 4732	4688	rundll32.exe	78
PID 4688 wrote to memory of 4732	4688	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4cdd8c0e732dc1f6393fff99513421848f8721964a7f9dafa5781e051d4f25aa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4688
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4cdd8c0e732dc1f6393fff99513421848f8721964a7f9dafa5781e051d4f25aa.dll,#1
  2⤵
  PID:4732

memory/4732-132-0x0000000000000000-mapping.dmp

Download
memory/4732-133-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download