d58f490a9a2e6ff540a77191b3dc771f5f5407040ed2c07db1ad945415f29d64

Analysis

max time kernel
101s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
16-12-2022 02:17

Target

2012-57-0x0000000002040000-0x000000000206A000-memory.dll
Size

168KB
MD5

6d731532dc8e55de4c59a6584d8b2dd8
SHA1

72c1089f1ea58da01815fa87f2013862b944a947
SHA256

d58f490a9a2e6ff540a77191b3dc771f5f5407040ed2c07db1ad945415f29d64
SHA512

0e7cbccd1d5df16f3f074587b187886026a8c92685edd5b450fb82eddcaf1325d94f4fc46fec654e8bee8478d634cfe98a46fd17c36076a02e8f6367c76d1a02
SSDEEP

3072:4gi/4ZXJDpi80XfLzCANdOJ6benWTTBfJWJO/ya3cv:6w5N30PLzHGJtnWTTBBWg/

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2700 wrote to memory of 1388	2700	rundll32.exe	rundll32.exe
PID 2700 wrote to memory of 1388	2700	rundll32.exe	rundll32.exe
PID 2700 wrote to memory of 1388	2700	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2012-57-0x0000000002040000-0x000000000206A000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2700

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2012-57-0x0000000002040000-0x000000000206A000-memory.dll,#1
2⤵
PID:1388