9448f1d1a581a4e4c5830e8d4f4c3a6db572eac190ec63178c9020fde2cf4f49

Analysis

max time kernel
91s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 12:11

Target

9448f1d1a581a4e4c5830e8d4f4c3a6db572eac190ec63178c9020fde2cf4f49.dll
Size

100KB
MD5

6206aa4f1f068eb07f2178898c39af42
SHA1

e7e3d373f12050693502ea18f9bacc490c8af2ea
SHA256

9448f1d1a581a4e4c5830e8d4f4c3a6db572eac190ec63178c9020fde2cf4f49
SHA512

849dfd132cc8ecc167af2c1437ad80650e0949766c6eae6c9e2d4c6f024d542048c06fc110c52344e3f1d9ff7187c959d25345baed4ee23fe9cfbabd4fc75b21
SSDEEP

1536:fDpVWfsTqgpbD1pR0Fkvbs70zXqOJG9uXptp+6tIgaKxFISWedsXo4FYESM9:7/Rpf1p8kv5D1bJt7tISWrBmS

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4072 wrote to memory of 2004	4072	rundll32.exe	80
PID 4072 wrote to memory of 2004	4072	rundll32.exe	80
PID 4072 wrote to memory of 2004	4072	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9448f1d1a581a4e4c5830e8d4f4c3a6db572eac190ec63178c9020fde2cf4f49.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4072
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9448f1d1a581a4e4c5830e8d4f4c3a6db572eac190ec63178c9020fde2cf4f49.dll,#1
  2⤵
  PID:2004

memory/2004-133-0x0000000010000000-0x0000000010024000-memory.dmp

Filesize
144KB

Download
memory/2004-134-0x0000000000C60000-0x0000000000C6A000-memory.dmp

Filesize
40KB

Download
memory/2004-138-0x0000000010000000-0x0000000010024000-memory.dmp

Filesize
144KB

Download