c681f3500cfed68d680eb23eb935f8c0585cd2c79cd1cb57c690a74406043f40

Analysis

max time kernel
155s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2022 06:20

Target

c681f3500cfed68d680eb23eb935f8c0585cd2c79cd1cb57c690a74406043f40.dll
Size

420KB
MD5

42d8de138538e60fac3e081c16d49c80
SHA1

0a55f63e64db37577fb589ee4c0e8957c067005d
SHA256

c681f3500cfed68d680eb23eb935f8c0585cd2c79cd1cb57c690a74406043f40
SHA512

ddf79c801ef6043cf57ed83642266b1c62e94f90bfade09681debdc315e988836857e491fb64b212c7411d54987e5d741e73fc18568c207745d4710dd6eb5b87
SSDEEP

6144:xJTOJIq+rO9cdPysczfl0SRHwiorbjznDzKCgmNOXmjIwD5AgMygHHaPRz:xJTOG9nXchFRH0vD1gmN3kwqVHG

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4636 wrote to memory of 444	4636	rundll32.exe	79
PID 4636 wrote to memory of 444	4636	rundll32.exe	79
PID 4636 wrote to memory of 444	4636	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c681f3500cfed68d680eb23eb935f8c0585cd2c79cd1cb57c690a74406043f40.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c681f3500cfed68d680eb23eb935f8c0585cd2c79cd1cb57c690a74406043f40.dll,#1
  2⤵
  PID:444

memory/444-132-0x0000000000000000-mapping.dmp

Download
memory/444-133-0x0000000002460000-0x0000000002497000-memory.dmp

Filesize
220KB

Download
memory/444-134-0x00000000024A0000-0x0000000002509000-memory.dmp

Filesize
420KB

Download
memory/444-138-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/444-139-0x0000000002460000-0x0000000002497000-memory.dmp

Filesize
220KB

Download