ad4145b97ef5cfb67409d729d5d636365051f79ae20a57fbd2331921e67cab7a

Analysis

max time kernel
162s
max time network
186s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
04-12-2022 12:31

Target

ad4145b97ef5cfb67409d729d5d636365051f79ae20a57fbd2331921e67cab7a.dll
Size

79KB
MD5

22cf3159e32151b80fb852827bad69b0
SHA1

b25badca730af5ed812726d1595012332ecf47ae
SHA256

ad4145b97ef5cfb67409d729d5d636365051f79ae20a57fbd2331921e67cab7a
SHA512

9ba1cd1aeb211f512b772e9d41c1a813adc040b0e5bba20da73d4f164c04c8adf3a3e35bd9974df07efbe556601a1016acb5d0969b62531ae0edfaa84d65b79a
SSDEEP

1536:wZpJI79i8XwGryTsKWsO7oK+A7V2ITaFITaHumKWxjDLF0eZa:iJI79iIRrwtOoK+A70IWFIWXxHeeZa

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 4076	1492	rundll32.exe	81
PID 1492 wrote to memory of 4076	1492	rundll32.exe	81
PID 1492 wrote to memory of 4076	1492	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ad4145b97ef5cfb67409d729d5d636365051f79ae20a57fbd2331921e67cab7a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ad4145b97ef5cfb67409d729d5d636365051f79ae20a57fbd2331921e67cab7a.dll,#1
  2⤵
  PID:4076

memory/4076-132-0x0000000000000000-mapping.dmp

Download
memory/4076-134-0x0000000010021000-0x0000000010029000-memory.dmp

Filesize
32KB

Download
memory/4076-135-0x0000000010020000-0x0000000010037000-memory.dmp

Filesize
92KB

Download