a14b3623c0480deaddce3bce30f829d76fb71a6eaa10b082adb2a70796cb7093

Analysis

max time kernel
198s
max time network
210s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
07/12/2022, 02:39

Target

a14b3623c0480deaddce3bce30f829d76fb71a6eaa10b082adb2a70796cb7093.dll
Size

84KB
MD5

4c9e5b98516fbfa3ea653d4627bce6f3
SHA1

8fa523c14fc54292c9c2244f2c5ec91b906d5042
SHA256

a14b3623c0480deaddce3bce30f829d76fb71a6eaa10b082adb2a70796cb7093
SHA512

5f8c41919a970aa334249ccc00abe670193053c355100541a12ee29a303a81114d096e65da97e6b978fa72684ba18bcb09537c4688be3573366d50c1cbb374f9
SSDEEP

1536:DzbPdb+1vroVtWVS7i7ZA3Xm0sW+kSj9j7:DzbAtoV8VtAHm0spj9j7

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4752 wrote to memory of 4828	4752	rundll32.exe	79
PID 4752 wrote to memory of 4828	4752	rundll32.exe	79
PID 4752 wrote to memory of 4828	4752	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a14b3623c0480deaddce3bce30f829d76fb71a6eaa10b082adb2a70796cb7093.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4752
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a14b3623c0480deaddce3bce30f829d76fb71a6eaa10b082adb2a70796cb7093.dll,#1
  2⤵
  PID:4828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4828 -ip 4828
1⤵
PID:1880

memory/4828-133-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/4828-134-0x0000000002570000-0x0000000002657000-memory.dmp

Filesize
924KB

Download