bbfed37c1aba30d477ba3b92b88e8a2205e22482805a1ce5e7a80ef6aa21e68a

Analysis

max time kernel
180s
max time network
193s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 07:31

Target

bbfed37c1aba30d477ba3b92b88e8a2205e22482805a1ce5e7a80ef6aa21e68a.dll
Size

336KB
MD5

c69287d0b4d4cb9be14243992d4dd6a0
SHA1

3c7e53568078d291850e8ba18100685c7d7a18a1
SHA256

bbfed37c1aba30d477ba3b92b88e8a2205e22482805a1ce5e7a80ef6aa21e68a
SHA512

e2844226033f2098ac1e935be60ab543e1c9eb5fb35256e8abd0c841688d180030cb10ac35d18887f6160b5183ca821342e31776cb5670820dfe453b7f2069a3
SSDEEP

6144:vuTBqGld+5XZHxvd4nMy61KDU0gLfMO0oMszlDIP9ZKUc4X480TRvGZCu9S6dd:bGd+5XswETy98Cu8k

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4844 wrote to memory of 1320	4844	rundll32.exe	82
PID 4844 wrote to memory of 1320	4844	rundll32.exe	82
PID 4844 wrote to memory of 1320	4844	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bbfed37c1aba30d477ba3b92b88e8a2205e22482805a1ce5e7a80ef6aa21e68a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4844
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bbfed37c1aba30d477ba3b92b88e8a2205e22482805a1ce5e7a80ef6aa21e68a.dll,#1
  2⤵
  PID:1320

memory/1320-133-0x0000000010000000-0x0000000010057000-memory.dmp

Filesize
348KB

Download