73bfaabb559c4ebcf2c64f93175b8b46c521d51d7b84432133ffffd26cefab00

Analysis

max time kernel
74s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
21/12/2022, 18:48

Target

73bfaabb559c4ebcf2c64f93175b8b46c521d51d7b84432133ffffd26cefab00.dll
Size

776KB
MD5

6b2356476fc7e35b8e5e77ef42a98e63
SHA1

4038b32abecc8bd68c733028a6bae694ab64bbd2
SHA256

73bfaabb559c4ebcf2c64f93175b8b46c521d51d7b84432133ffffd26cefab00
SHA512

473bf6ab029cc69af452ead9c57454cfbc2fed6baca0e2784d8afa4a9939d9690b97deade8ec7b06190d1aa0d7906a75de1d77b7e20280c7314862d1110b676d
SSDEEP

12288:zjTDqQF7a5NO9gyB5Jr1w2MhrsvgQYs30G3EJRtjrMLE+y/tSqU7:zzqQRaSv1+hovYsEGuRtsE+y/tSD7

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4912 wrote to memory of 4804	4912	rundll32.exe	82
PID 4912 wrote to memory of 4804	4912	rundll32.exe	82
PID 4912 wrote to memory of 4804	4912	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\73bfaabb559c4ebcf2c64f93175b8b46c521d51d7b84432133ffffd26cefab00.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4912
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\73bfaabb559c4ebcf2c64f93175b8b46c521d51d7b84432133ffffd26cefab00.dll,#1
  2⤵
  PID:4804

memory/4804-133-0x0000000000FF0000-0x000000000102E000-memory.dmp

Filesize
248KB

Download
memory/4804-138-0x0000000000FF1000-0x0000000001018000-memory.dmp

Filesize
156KB

Download