3fdee2d2586b07fd0a5e85c13dedbc49954a8c13e033cecfc1d6efb15146ac5e

Analysis

max time kernel
152s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 14:57

Target

3fdee2d2586b07fd0a5e85c13dedbc49954a8c13e033cecfc1d6efb15146ac5e.dll
Size

151KB
MD5

1a35c5c6f87e0121d66d2f2db274eff9
SHA1

c3b87b5707025bfec9fd935746d67a42725aa8f5
SHA256

3fdee2d2586b07fd0a5e85c13dedbc49954a8c13e033cecfc1d6efb15146ac5e
SHA512

be6e1b346d3c33982b7d2ba0cd3ddcae30586478df5e49d5d26f4e65633bba7c6b8686c685dcef3dbb061e4816272781d01e9e0b86cded992b5144472a056eb9
SSDEEP

1536:tIsIwXI2IuIJkuvfZ/AuwtICVmG04D6OFcK5vcZSFCtluRR3u5xUSTP:t7ZFNyxvfGx04iK5yy9u5x

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4392 wrote to memory of 4384	4392	rundll32.exe	83
PID 4392 wrote to memory of 4384	4392	rundll32.exe	83
PID 4392 wrote to memory of 4384	4392	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3fdee2d2586b07fd0a5e85c13dedbc49954a8c13e033cecfc1d6efb15146ac5e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4392
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3fdee2d2586b07fd0a5e85c13dedbc49954a8c13e033cecfc1d6efb15146ac5e.dll,#1
  2⤵
  PID:4384

memory/4384-133-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download