ee6516675bfa2c5ba701fc07e377f942dbf7163ef2a8719d9c6de9701c264bc8

Analysis

max time kernel
70s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 11:03

Target

ee6516675bfa2c5ba701fc07e377f942dbf7163ef2a8719d9c6de9701c264bc8.dll
Size

97KB
MD5

683ca06bf74fa53494706d92aa9f61a6
SHA1

2172f5cf59fd1819f6778b66266083dfa23acc2a
SHA256

ee6516675bfa2c5ba701fc07e377f942dbf7163ef2a8719d9c6de9701c264bc8
SHA512

bf65134475b6d8ec94d83e56820ebcadf3b6dbc499d1d3c5da9e6209e64f41fccdc142cc0905274854f262245cab0ee55be015de1ad96d5df3fdde6f756d4f0a
SSDEEP

1536:Ncp1qjZJYQX4GbX0k33balxKDrGb4yedxliqkfApbM6p8BSW:apwjZ+S4Gb2lgCbTyoYpzp8

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 880 wrote to memory of 4044	880	rundll32.exe	79
PID 880 wrote to memory of 4044	880	rundll32.exe	79
PID 880 wrote to memory of 4044	880	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ee6516675bfa2c5ba701fc07e377f942dbf7163ef2a8719d9c6de9701c264bc8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:880
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ee6516675bfa2c5ba701fc07e377f942dbf7163ef2a8719d9c6de9701c264bc8.dll,#1
  2⤵
  PID:4044

memory/4044-133-0x0000000010000000-0x0000000010024000-memory.dmp

Filesize
144KB

Download
memory/4044-134-0x0000000000A50000-0x0000000000A5A000-memory.dmp

Filesize
40KB

Download
memory/4044-138-0x0000000010000000-0x0000000010024000-memory.dmp

Filesize
144KB

Download