b628963fd2d5a7458466966c01c09615a64f112b5ce6e8ad0fabb7dd7e29c0f8

Analysis

max time kernel
145s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 15:07

Target

b628963fd2d5a7458466966c01c09615a64f112b5ce6e8ad0fabb7dd7e29c0f8.dll
Size

78KB
MD5

69dd16ed5d913c8814826d70682f3115
SHA1

b180535cf70c41dd4b1de0a061202b4675f67cb3
SHA256

b628963fd2d5a7458466966c01c09615a64f112b5ce6e8ad0fabb7dd7e29c0f8
SHA512

54e3443ec1394c3f056b1ca4a2a1b9047dcc021b31f0fb2a1d1a7017049a276d4f53b169259077b44985bd441db2fb549ebe8548e94a57ca0c0aa496448fbab3
SSDEEP

1536:GpHzfzXNa8RyA1DecJvW7xL0454HleWqWirEr0VOmFZd6JBwAwgsAITqHk/RBJYz:GpTfzE0xd/JuF2oHEmF6JBwAlJj8RbQ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4864 wrote to memory of 4932	4864	rundll32.exe	81
PID 4864 wrote to memory of 4932	4864	rundll32.exe	81
PID 4864 wrote to memory of 4932	4864	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b628963fd2d5a7458466966c01c09615a64f112b5ce6e8ad0fabb7dd7e29c0f8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4864
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b628963fd2d5a7458466966c01c09615a64f112b5ce6e8ad0fabb7dd7e29c0f8.dll,#1
  2⤵
  PID:4932

memory/4932-133-0x0000000000010000-0x0000000000023000-memory.dmp

Filesize
76KB

Download