a14b3623c0480deaddce3bce30f829d76fb71a6eaa10b082adb2a70796cb7093

Analysis

max time kernel
198s
max time network
210s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
07/12/2022, 02:39

Target
a14b3623c0480deaddce3bce30f829d76fb71a6eaa10b082adb2a70796cb7093.dll
Size 84KB
Sample221207-c5evcsbc2z
SHA256 a14b3623c0480deaddce3bce30f829d76fb71a6eaa10b082adb2a70796cb7093
MD5 4c9e5b98516fbfa3ea653d4627bce6f3
SHA1 8fa523c14fc54292c9c2244f2c5ec91b906d5042
SHA512 5f8c41919a970aa334249ccc00abe670193053c355100541a12ee29a303a81114d096e65da97e6b978fa72684ba18bcb09537c4688be3573366d50c1cbb374f9
SSDEEP 1536:DzbPdb+1vroVtWVS7i7ZA3Xm0sW+kSj9j7:DzbAtoV8VtAHm0spj9j7
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4752 wrote to memory of 4828	4752	rundll32.exe	79
PID 4752 wrote to memory of 4828	4752	rundll32.exe	79
PID 4752 wrote to memory of 4828	4752	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a14b3623c0480deaddce3bce30f829d76fb71a6eaa10b082adb2a70796cb7093.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4752
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a14b3623c0480deaddce3bce30f829d76fb71a6eaa10b082adb2a70796cb7093.dll,#1
  2⤵
  PID:4828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4828 -ip 4828
1⤵
PID:1880

memory/4828-133-0x0000000010000000-0x0000000010021000-memory.dmp

Download

memory/4828-134-0x0000000002570000-0x0000000002657000-memory.dmp

Download