90c0b49156b56e94d005c082e5e4117ea89a9cd347f468bc7f3015b265bf64d5

Analysis

max time kernel
151s
max time network
181s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 07:43

Target

90c0b49156b56e94d005c082e5e4117ea89a9cd347f468bc7f3015b265bf64d5.dll
Size

37KB
MD5

2e176f85b516380ece489ab0e6261967
SHA1

3c85fdeb9e424d3309519791c69f4a37fc862caf
SHA256

90c0b49156b56e94d005c082e5e4117ea89a9cd347f468bc7f3015b265bf64d5
SHA512

18b35562260b5c0fd87236809a9d5d9384231d64326cbc58033547e02c48d2d8ae72baa4d48675a5b8f0cf6d087d1ef7aeab07a6554dde06cc5b860059ab0e07
SSDEEP

768:dzR5dEf6S9BxCIPLqgADFJwe/fOjBeDr/qNlDLdE:daf6S9WoNADFJNy4DYDR

Score

1^/10

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 3456	2124	rundll32.exe	84
PID 2124 wrote to memory of 3456	2124	rundll32.exe	84
PID 2124 wrote to memory of 3456	2124	rundll32.exe	84
PID 3456 wrote to memory of 2972	3456	rundll32.exe	85
PID 3456 wrote to memory of 2972	3456	rundll32.exe	85
PID 3456 wrote to memory of 2972	3456	rundll32.exe	85
PID 2972 wrote to memory of 632	2972	net.exe	87
PID 2972 wrote to memory of 632	2972	net.exe	87
PID 2972 wrote to memory of 632	2972	net.exe	87
PID 3456 wrote to memory of 216	3456	rundll32.exe	88
PID 3456 wrote to memory of 216	3456	rundll32.exe	88
PID 3456 wrote to memory of 216	3456	rundll32.exe	88
PID 216 wrote to memory of 1540	216	net.exe	90
PID 216 wrote to memory of 1540	216	net.exe	90
PID 216 wrote to memory of 1540	216	net.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\90c0b49156b56e94d005c082e5e4117ea89a9cd347f468bc7f3015b265bf64d5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\90c0b49156b56e94d005c082e5e4117ea89a9cd347f468bc7f3015b265bf64d5.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3456
- - C:\Windows\SysWOW64\net.exe
    net stop winss
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2972
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop winss
      4⤵
      PID:632
- - C:\Windows\SysWOW64\net.exe
    net stop OcHealthMon
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:216
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop OcHealthMon
      4⤵
      PID:1540

memory/3456-133-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/3456-134-0x0000000000460000-0x0000000000465000-memory.dmp

Filesize
20KB

Download