41e1927a8206853be758473f7616c4fc82c1f9efbd90d25dde8973a82f23e391

Analysis

max time kernel
227s
max time network
294s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 14:54

Target

41e1927a8206853be758473f7616c4fc82c1f9efbd90d25dde8973a82f23e391.dll
Size

441KB
MD5

8339227f255d1ae6ba408efd5c31a0f5
SHA1

6f00b2777531c106daafc56736096b085056c412
SHA256

41e1927a8206853be758473f7616c4fc82c1f9efbd90d25dde8973a82f23e391
SHA512

60c238b3909676f0b48cc4a5e3d267b1e3d01f74cf618b9ef3d73f1ee0fc99ecf6b90441f4134ea59b01c71a98976bfc99caeee586e52f826f94ef9607d64939
SSDEEP

12288:DDPnR/VwEJTYoiwTo27888888888888W888888888883:vBVwEJTtTo2

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 920	2556	rundll32.exe	80
PID 2556 wrote to memory of 920	2556	rundll32.exe	80
PID 2556 wrote to memory of 920	2556	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\41e1927a8206853be758473f7616c4fc82c1f9efbd90d25dde8973a82f23e391.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\41e1927a8206853be758473f7616c4fc82c1f9efbd90d25dde8973a82f23e391.dll,#1
  2⤵
  PID:920

memory/920-133-0x0000000002020000-0x0000000002099000-memory.dmp

Filesize
484KB

Download