d48d11c24175e6dc9e4320c19a9febc07e64c3b0719d3e3f873b3d61c414a112

Analysis

max time kernel
144s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 01:49

Target

d48d11c24175e6dc9e4320c19a9febc07e64c3b0719d3e3f873b3d61c414a112.dll
Size

242KB
MD5

068812135d4a3658d55c712734962e95
SHA1

a8c9b02fc96e463c44620167cc99d70c58571a0d
SHA256

d48d11c24175e6dc9e4320c19a9febc07e64c3b0719d3e3f873b3d61c414a112
SHA512

a810eb0ce950553aa5f79ed01718b33fa9cf75155652e4b02abcb6d7a4616c0491bc6841301b44f612b54de6d0ddcf50d09ed9b3e3e6e2f051483e32f07e4a82
SSDEEP

3072:OoyxvfGPCXZsxMeZMN+ckS9drqnS20YVbQ3uiShzulSgvc:OoQfW2ZsSeiLYVCuisWvc

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4056 wrote to memory of 4648	4056	rundll32.exe	79
PID 4056 wrote to memory of 4648	4056	rundll32.exe	79
PID 4056 wrote to memory of 4648	4056	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d48d11c24175e6dc9e4320c19a9febc07e64c3b0719d3e3f873b3d61c414a112.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4056
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d48d11c24175e6dc9e4320c19a9febc07e64c3b0719d3e3f873b3d61c414a112.dll,#1
  2⤵
  PID:4648

memory/4648-133-0x0000000010000000-0x0000000010040000-memory.dmp

Filesize
256KB

Download