a58b77779e1c7df098218cc3eb8ac27715482666adb60294b7077ed1dcbb000b

Analysis

max time kernel
90s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 12:12

Target

a58b77779e1c7df098218cc3eb8ac27715482666adb60294b7077ed1dcbb000b.dll
Size

160KB
MD5

74effce53e0f45d004f437c42a3b18b6
SHA1

94e9b6672bad0f11b2baf4d0c962bdb35b142f3f
SHA256

a58b77779e1c7df098218cc3eb8ac27715482666adb60294b7077ed1dcbb000b
SHA512

72e6401de88e7f0cdbf1cd05acba58e3b4da48e2341bc33de6208b8b6e2d2995422bf06a694078af64354f4987ca6cb54f4dadb65ea895f8935d64d2ecaef88e
SSDEEP

3072:69d7aBDTeFHgWPrWqSnMMxjTdPDfBqBBwJkjxUYt:6P7DH1KBjTdLwHMQ+Y

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 1628	2328	rundll32.exe	80
PID 2328 wrote to memory of 1628	2328	rundll32.exe	80
PID 2328 wrote to memory of 1628	2328	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a58b77779e1c7df098218cc3eb8ac27715482666adb60294b7077ed1dcbb000b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a58b77779e1c7df098218cc3eb8ac27715482666adb60294b7077ed1dcbb000b.dll,#1
  2⤵
  PID:1628

memory/1628-133-0x0000000010000000-0x0000000010029000-memory.dmp

Filesize
164KB

Download
memory/1628-134-0x0000000000AC0000-0x0000000000ACF000-memory.dmp

Filesize
60KB

Download
memory/1628-135-0x0000000000AD0000-0x0000000000ADE000-memory.dmp

Filesize
56KB

Download