b2161dc3663ffb4f511fa2994f910decc915285362d78579202919aa09910883

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 08:38

Target

b2161dc3663ffb4f511fa2994f910decc915285362d78579202919aa09910883.dll
Size

331KB
MD5

d36031bcea5346d1bd648094f0c9c050
SHA1

258cc8a38acd7a36e7b3b0a1711569a0ec40542a
SHA256

b2161dc3663ffb4f511fa2994f910decc915285362d78579202919aa09910883
SHA512

d082b74cad84daa973780e73ebe85ad08834e66f9a622197fc26250dd27bd9766a1be16cc5488d04bfd177931bd6157eca264027f7891331fd3c8d68bdc9a785
SSDEEP

6144:IpXyySUDVtKgs3JTP4NgDQ6eNpLQoEQICS15xl3lD3Jrq9Uo8C:vzUTK93JMipGEoSnn1JUCC

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1232 wrote to memory of 4984	1232	rundll32.exe	82
PID 1232 wrote to memory of 4984	1232	rundll32.exe	82
PID 1232 wrote to memory of 4984	1232	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b2161dc3663ffb4f511fa2994f910decc915285362d78579202919aa09910883.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1232
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b2161dc3663ffb4f511fa2994f910decc915285362d78579202919aa09910883.dll,#1
  2⤵
  PID:4984

memory/4984-133-0x0000000010000000-0x0000000010057000-memory.dmp

Filesize
348KB

Download