d492c44591d2497c712ac86801b28ba0c8ba3c8695ed4c1ec9349208afb9caca

Analysis

max time kernel
90s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2022 13:57

Target

d492c44591d2497c712ac86801b28ba0c8ba3c8695ed4c1ec9349208afb9caca.dll
Size

114KB
MD5

2f20e78396e3570cb3bfd832a473d94f
SHA1

9cbfa63274862ea7149bad10e1eadf3e49e6bc13
SHA256

d492c44591d2497c712ac86801b28ba0c8ba3c8695ed4c1ec9349208afb9caca
SHA512

9a1973fb12b63daa1c9ab20120c07f032f28aaf00cd25e1a9964ae7b15083daea1ade1f98f6a42892285e4fc9764b67d017bb85412ff118acc19e10e1f7b45ee
SSDEEP

3072:DVtpImlWZCuscVVus4wVGS8Dxm9nrPOD:DuzCuscPus5VGgRPOD

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5036 wrote to memory of 4944	5036	rundll32.exe	81
PID 5036 wrote to memory of 4944	5036	rundll32.exe	81
PID 5036 wrote to memory of 4944	5036	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d492c44591d2497c712ac86801b28ba0c8ba3c8695ed4c1ec9349208afb9caca.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d492c44591d2497c712ac86801b28ba0c8ba3c8695ed4c1ec9349208afb9caca.dll,#1
  2⤵
  PID:4944

memory/4944-132-0x0000000000000000-mapping.dmp

Download
memory/4944-133-0x0000000002DA0000-0x0000000002DAA000-memory.dmp

Filesize
40KB

Download
memory/4944-137-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download