ba9cd1865892ff583d0777c7ce2b969de324e5a295afab5f3626a8b95ed33658

Analysis

max time kernel
123s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 07:42

Target

ba9cd1865892ff583d0777c7ce2b969de324e5a295afab5f3626a8b95ed33658.dll
Size

356KB
MD5

8cd810720c65d316a65bf8701639654b
SHA1

861d0a8a9c81f573dedc7d4cd00f5f31cbf89164
SHA256

ba9cd1865892ff583d0777c7ce2b969de324e5a295afab5f3626a8b95ed33658
SHA512

59fd9649d93c054dcba5ab8075caf5e579e6f4bfa9e76015cecf93f946892b5b58a37b263ec9adb66b5c13246727bca7bb54d862ae8fe475403b314489856783
SSDEEP

6144:bVEtwQs2cAGIgXpB4COUmqoCRPOVecAGOi9BKJ163FxCnwIkhvKqP:bStkAGIgXpB460EPGO+Bg63FAuvKo

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4940	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 4940	1944	rundll32.exe	82
PID 1944 wrote to memory of 4940	1944	rundll32.exe	82
PID 1944 wrote to memory of 4940	1944	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ba9cd1865892ff583d0777c7ce2b969de324e5a295afab5f3626a8b95ed33658.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ba9cd1865892ff583d0777c7ce2b969de324e5a295afab5f3626a8b95ed33658.dll,#1
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:4940

memory/4940-133-0x0000000010000000-0x000000001005C000-memory.dmp

Filesize
368KB

Download
memory/4940-134-0x0000000002630000-0x0000000002730000-memory.dmp

Filesize
1024KB

Download