d806243bdf79675d351bc3874854470b970bf8153efbfbc2e71d5faea2c340c0

Analysis

max time kernel
154s
max time network
177s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04-12-2022 14:00

Target

d806243bdf79675d351bc3874854470b970bf8153efbfbc2e71d5faea2c340c0.dll
Size

16KB
MD5

03c021b4f045fd4d17f609bd1a9a22f0
SHA1

eee6f2ebba5daab9cc4fefb6138ea72f09937073
SHA256

d806243bdf79675d351bc3874854470b970bf8153efbfbc2e71d5faea2c340c0
SHA512

d6dfb07f30a444bedd033f457a99678250c1a61fb7c607f7f67da2770c71327fb57e7cc3453fabaa4a235e0eb4619987c7ee3247093a6b13d8fcf20650b7bdde
SSDEEP

384:LtT0SWA7/GXmpUNn4iRZhAG4WvYwUmztjbRKo:JT0qmznB6rwUmRvRt

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4120 wrote to memory of 1732	4120	rundll32.exe	72
PID 4120 wrote to memory of 1732	4120	rundll32.exe	72
PID 4120 wrote to memory of 1732	4120	rundll32.exe	72

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d806243bdf79675d351bc3874854470b970bf8153efbfbc2e71d5faea2c340c0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4120
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d806243bdf79675d351bc3874854470b970bf8153efbfbc2e71d5faea2c340c0.dll,#1
  2⤵
  PID:1732

memory/1732-136-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download