f86e61cb80208cfaa2166dffe9344417a4183a40734d719c3f52799b08deccc0

Analysis

max time kernel
157s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 09:12

Target

f86e61cb80208cfaa2166dffe9344417a4183a40734d719c3f52799b08deccc0.dll
Size

46KB
MD5

1dfbcd49f5bcc529f86fe5cc77fa23dd
SHA1

1839ba3c3195eab7b80d98dcd90ee0cd2f9600a4
SHA256

f86e61cb80208cfaa2166dffe9344417a4183a40734d719c3f52799b08deccc0
SHA512

28a31278fb375629568305252d0940850f352304698d3a9e8da4fd78702acb32381e5b1e2a3194e28426de5b0e245ea718ad31e77a05c9f270e0252e44078778
SSDEEP

768:JwxTSAynbxUW/MT+Nmrp1RfS44r6L+do+ggyOYBaYslkBZj:JwZSAy1b/MCNwhS4C6z+gVXkwj

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4500 wrote to memory of 1680	4500	rundll32.exe	84
PID 4500 wrote to memory of 1680	4500	rundll32.exe	84
PID 4500 wrote to memory of 1680	4500	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f86e61cb80208cfaa2166dffe9344417a4183a40734d719c3f52799b08deccc0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4500
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f86e61cb80208cfaa2166dffe9344417a4183a40734d719c3f52799b08deccc0.dll,#1
  2⤵
  PID:1680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1680 -ip 1680
1⤵
PID:4060

memory/1680-133-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download