bddedf034c4e9ea9195314fa36f148e559611d580482bb54bf6b0cce712e2356

Analysis

max time kernel
175s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 01:19

Target

bddedf034c4e9ea9195314fa36f148e559611d580482bb54bf6b0cce712e2356.dll
Size

55KB
MD5

a0af9cd38a74db682ee01069a5ae687c
SHA1

ef2b6e5244c884dbf299d583b663631434b0df4e
SHA256

bddedf034c4e9ea9195314fa36f148e559611d580482bb54bf6b0cce712e2356
SHA512

c071607af09b41bb74b64f3c0bed140006ee71116f699e40eb87ae7b583440d2d03a9df59743d758e1222cef06548c2298e6b8e8576d7cda7f6451ac77dd1a59
SSDEEP

1536:agF0eiyUcbYMuZ7q439eCkS4ihxqfdY2+ePSpAdwg9mQ0:t2yFD6z39hL4ivB8S+p/0

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3836 wrote to memory of 1268	3836	rundll32.exe	82
PID 3836 wrote to memory of 1268	3836	rundll32.exe	82
PID 3836 wrote to memory of 1268	3836	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bddedf034c4e9ea9195314fa36f148e559611d580482bb54bf6b0cce712e2356.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3836
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bddedf034c4e9ea9195314fa36f148e559611d580482bb54bf6b0cce712e2356.dll,#1
  2⤵
  PID:1268

memory/1268-133-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download