8dd9119088b5afc0018e5c6516fe2e73d3ca22bc667e4ab4ed854fe3fcb3437b

Analysis

max time kernel
156s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2022 09:25

Target

8dd9119088b5afc0018e5c6516fe2e73d3ca22bc667e4ab4ed854fe3fcb3437b.dll
Size

183KB
MD5

8f76372b67cfc5e3d5a4a8e056724eb0
SHA1

761cff1d3468d0dfa1fbbe8369011eebe89380a4
SHA256

8dd9119088b5afc0018e5c6516fe2e73d3ca22bc667e4ab4ed854fe3fcb3437b
SHA512

485c8f0019126a770e9dbbe50e982905655b93c5fae41cefeb3a40a83bc925284ccc9107777816d13a37b2b81db82998a1a2d660b4065f94334549b25f6ff0f9
SSDEEP

3072:GrS1n7jeffJHoJQZJq3JsvCQA12ClmeUvR8I/U+owztYcegkZq9lz7VOfy+1iVyK:GaCoJ0Q3MIr5UyiU+dOgaq9lz7VdPyE7

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1068 wrote to memory of 1944	1068	rundll32.exe	81
PID 1068 wrote to memory of 1944	1068	rundll32.exe	81
PID 1068 wrote to memory of 1944	1068	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8dd9119088b5afc0018e5c6516fe2e73d3ca22bc667e4ab4ed854fe3fcb3437b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1068
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8dd9119088b5afc0018e5c6516fe2e73d3ca22bc667e4ab4ed854fe3fcb3437b.dll,#1
  2⤵
  PID:1944

memory/1944-133-0x0000000000000000-mapping.dmp

Download
memory/1944-134-0x0000000010000000-0x0000000010017000-memory.dmp

Filesize
92KB

Download