bcd9adc1fdd8b40edc6662e9834464fcf2c236efb177b037bff09b810009b118

Analysis

max time kernel
182s
max time network
204s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 06:06

Target

bcd9adc1fdd8b40edc6662e9834464fcf2c236efb177b037bff09b810009b118.dll
Size

24KB
MD5

9ecbd385a870fff5012647fd51d1c0a5
SHA1

41345efda011931c3da8c848185569b2bd86829d
SHA256

bcd9adc1fdd8b40edc6662e9834464fcf2c236efb177b037bff09b810009b118
SHA512

5c80f3fecdbd3c7f286bb0fb728bf58d491a6d338b3a38141b8a3451adbad6e86d89d58e5047fd04dc9762df039ca5205c553c5ed2744abda945d3a1a647a851
SSDEEP

192:eIH0L5h0CDehzsHSXyHAcR/iElcB7uoV1BYFzN8r:+cHyHAc1/lcpuIsFzNC

Score

5^/10

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\kasgfka.dll	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 3064	1960	rundll32.exe	83
PID 1960 wrote to memory of 3064	1960	rundll32.exe	83
PID 1960 wrote to memory of 3064	1960	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bcd9adc1fdd8b40edc6662e9834464fcf2c236efb177b037bff09b810009b118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bcd9adc1fdd8b40edc6662e9834464fcf2c236efb177b037bff09b810009b118.dll,#1
  2⤵
  - Drops file in System32 directory
  PID:3064

memory/3064-133-0x0000000068080000-0x0000000068086000-memory.dmp

Filesize
24KB

Download