91fae306f6a4b6c590f04300bb5ac262958d8104d2f3dcdd0e82c39cb726e994

Analysis

max time kernel
168s
max time network
177s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2022 20:26

Target

91fae306f6a4b6c590f04300bb5ac262958d8104d2f3dcdd0e82c39cb726e994.dll
Size

108KB
MD5

e46a5660131404fa71a6f9f2e672b344
SHA1

b7523be159f92fe44295ae517a73babe9439fe16
SHA256

91fae306f6a4b6c590f04300bb5ac262958d8104d2f3dcdd0e82c39cb726e994
SHA512

523054acb79c69ce4d88a6d4f82bfab0694b7b155322beeb2aca9a693351a7150b58630ffe0093e1aaacae4fe5f95d2e22e47b731cc6ab0d47eefc061ef5b96f
SSDEEP

1536:TD6K271gp7DXHQ49AmcM3UwAGFhtCUZCdgNg/9ZlBfZ9rwEIL30:TDGYLww/cMEwAGFhtAdUgl39rDILk

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4084 wrote to memory of 4964	4084	rundll32.exe	83
PID 4084 wrote to memory of 4964	4084	rundll32.exe	83
PID 4084 wrote to memory of 4964	4084	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\91fae306f6a4b6c590f04300bb5ac262958d8104d2f3dcdd0e82c39cb726e994.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4084
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\91fae306f6a4b6c590f04300bb5ac262958d8104d2f3dcdd0e82c39cb726e994.dll,#1
  2⤵
  PID:4964

memory/4964-132-0x0000000000000000-mapping.dmp

Download
memory/4964-133-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download