c4f040f5481c61edc22f2e389ef7bfb538bbeb9535b83e1ea69455fdf0efef71

Analysis

max time kernel
162s
max time network
189s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 20:26

Target

c4f040f5481c61edc22f2e389ef7bfb538bbeb9535b83e1ea69455fdf0efef71.dll
Size

70KB
MD5

cc36330dbc68755eead705a75738e1fc
SHA1

4460c53de7bdd31e1250fd1c011312e68ddca07a
SHA256

c4f040f5481c61edc22f2e389ef7bfb538bbeb9535b83e1ea69455fdf0efef71
SHA512

09c151560bac7b6e89a4d3d91eeb76e8d04d026990a0e25897be919cfc34aeda2e0c629a6ed8c199f94e75b7e8c514f8f12cc7038ab3c6d8488ec3c54271ac1f
SSDEEP

1536:DKMIguFe6X3Pl6yyYJ6+ejJgSyFcohbB1aw/9kC:DMdX3Pl6yyYAQv56qeC

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5032 wrote to memory of 2156	5032	rundll32.exe	82
PID 5032 wrote to memory of 2156	5032	rundll32.exe	82
PID 5032 wrote to memory of 2156	5032	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c4f040f5481c61edc22f2e389ef7bfb538bbeb9535b83e1ea69455fdf0efef71.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c4f040f5481c61edc22f2e389ef7bfb538bbeb9535b83e1ea69455fdf0efef71.dll,#1
  2⤵
  PID:2156

memory/2156-133-0x0000000010000000-0x0000000010970000-memory.dmp

Filesize
9.4MB

Download