ca2be698d42002651cb48e87f1b4f9ece27c36a9e9b5c00e3abf7401ee6b0798

Analysis

max time kernel
180s
max time network
189s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 11:13

Target

ca2be698d42002651cb48e87f1b4f9ece27c36a9e9b5c00e3abf7401ee6b0798.dll
Size

22KB
MD5

2ded9793ed5dcd3b35f1aa2b1a948c43
SHA1

7fa8fe6adc6f823b0d85c613ec606bb63c66a715
SHA256

ca2be698d42002651cb48e87f1b4f9ece27c36a9e9b5c00e3abf7401ee6b0798
SHA512

f24c3feed44d62585354ee2d59987189d7bacedc994ca157f7d2140ae24c948a3a4795d5aeed130ca7286474bbb85ddf8d2e9a0a1f3cae0269b60e17b0682ef1
SSDEEP

384:TeJu45MQ4DL1at6OatczF5ayVSy09BND/JzbqR8yEe5dB:M7W+6OatcFMmST9BNDgayE4

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2728 wrote to memory of 1712	2728	rundll32.exe	83
PID 2728 wrote to memory of 1712	2728	rundll32.exe	83
PID 2728 wrote to memory of 1712	2728	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ca2be698d42002651cb48e87f1b4f9ece27c36a9e9b5c00e3abf7401ee6b0798.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ca2be698d42002651cb48e87f1b4f9ece27c36a9e9b5c00e3abf7401ee6b0798.dll,#1
  2⤵
  PID:1712

memory/1712-133-0x0000000000B31000-0x0000000000B35000-memory.dmp

Filesize
16KB

Download