d009567c661e7120eaa66c1c735d17160cb9ac0e78c7d0dab0a35b08b9667913

Analysis

max time kernel
94s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07/12/2022, 02:03

Target

d009567c661e7120eaa66c1c735d17160cb9ac0e78c7d0dab0a35b08b9667913.dll
Size

87KB
MD5

c592ec4569cf6ce9089fdc2099e8da57
SHA1

be8025ebcd8bb1c3a641689916091ac1f24ad28d
SHA256

d009567c661e7120eaa66c1c735d17160cb9ac0e78c7d0dab0a35b08b9667913
SHA512

14530987e465e2afac6f7659748a3cf8a154f9ab1dc259bba223e4b903a2dddd722eb8ee1df5822903218463dafcdb919724ee689c6cc19df28f4913a9298292
SSDEEP

1536:6BMcxpVD9ZutmO6gjZ/A9+7q1N0dTdd0bF/GsM7VF+yARvyh7zKOkJMz/5xiTyPx:6BMUpnZu4b2uPUTddf+D1yh7zKXMz/5n

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3372 wrote to memory of 4292	3372	rundll32.exe	76
PID 3372 wrote to memory of 4292	3372	rundll32.exe	76
PID 3372 wrote to memory of 4292	3372	rundll32.exe	76

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d009567c661e7120eaa66c1c735d17160cb9ac0e78c7d0dab0a35b08b9667913.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3372
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d009567c661e7120eaa66c1c735d17160cb9ac0e78c7d0dab0a35b08b9667913.dll,#1
  2⤵
  PID:4292

memory/4292-133-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download