d152966a53a1a19eefdc81365fffc2c550fa83f2e07f51972f4b947ea50a31da

Analysis

max time kernel
174s
max time network
180s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 09:40

Target

d152966a53a1a19eefdc81365fffc2c550fa83f2e07f51972f4b947ea50a31da.dll
Size

368KB
MD5

434314e97ae563a7aec54a951652e098
SHA1

ae39b3530eb54bdecfd37e7e121c5bae6985d81b
SHA256

d152966a53a1a19eefdc81365fffc2c550fa83f2e07f51972f4b947ea50a31da
SHA512

8d5e76df67c956f58a66ae0070a758dc7300eecf5c03d9ef6848e2b1d4782a416411cb94b8c01f58c21ffcff3cf173ec3cc85df01bdd6865c3e7ba7301d3f990
SSDEEP

6144:oOdQNeWORa+vhOql8YY5wXRyl/AvVjN67OX9S2OuT250pPPdQhWFX4jVxiTQZ0ex:oOddWH+Zx8F5wXRuKjwUgCT2CAhWJSVP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 4956	2092	rundll32.exe	79
PID 2092 wrote to memory of 4956	2092	rundll32.exe	79
PID 2092 wrote to memory of 4956	2092	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d152966a53a1a19eefdc81365fffc2c550fa83f2e07f51972f4b947ea50a31da.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d152966a53a1a19eefdc81365fffc2c550fa83f2e07f51972f4b947ea50a31da.dll,#1
  2⤵
  PID:4956

memory/4956-133-0x0000000010000000-0x0000000010060000-memory.dmp

Filesize
384KB

Download