e2a9a00d2d3b32528e29695abe3639c5906af8c0c234a0100c0042d9d9782877

Analysis

max time kernel
90s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
04-12-2022 13:38

Target

e2a9a00d2d3b32528e29695abe3639c5906af8c0c234a0100c0042d9d9782877.dll
Size

60KB
MD5

5023830e65012875f9ceebd4f89d1f48
SHA1

28dfef278bd213a83fda053ae28a0c0758cf0c30
SHA256

e2a9a00d2d3b32528e29695abe3639c5906af8c0c234a0100c0042d9d9782877
SHA512

ccee4f1b28f5d127600ee01717ce71d9e1dc9dfd24ecb0ff975c82877dae586107d83204fe7232ee0a865ac94d29ab740a3b2c01e2f5b19338eb71c35a3ea23f
SSDEEP

768:F9htYuxxMz4m/0+m45dC66lsgrgipeaddlrTpEMaqZFI6rF2zRb1sueIxz9IsSnH:1VSzqiAls+gi0wvphy8F2zRb1suL9cH

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4900 wrote to memory of 2448	4900	rundll32.exe	80
PID 4900 wrote to memory of 2448	4900	rundll32.exe	80
PID 4900 wrote to memory of 2448	4900	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e2a9a00d2d3b32528e29695abe3639c5906af8c0c234a0100c0042d9d9782877.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4900
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e2a9a00d2d3b32528e29695abe3639c5906af8c0c234a0100c0042d9d9782877.dll,#1
  2⤵
  PID:2448

memory/2448-133-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download