dc051291eb8966db468687a7d65d9885490b4e8d540a03206b5493e55dd9436a

Analysis

max time kernel
117s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
14-01-2023 19:36

Target

18479a0a722d7346505ac27b20a8c4ea6ac8b087010a6ed02aeb5833c9d9e7ff.dll
Size

17KB
MD5

8085a7221b1ca6dc5be44e029c7eb9e7
SHA1

2bffedeea6da345f53d3c27b112b0a3fbc5bb22c
SHA256

18479a0a722d7346505ac27b20a8c4ea6ac8b087010a6ed02aeb5833c9d9e7ff
SHA512

0e7bda988276a5e6403884f3b60e932ea95ce259741091cb3d88f2662ae653955bd7c095c8c877d2e1437a72dd2db33156ca70b8409eb8547a8e1179f2fc6afd
SSDEEP

384:zYUp3v5kg3/Hgfm0FLcrTN1mItE8WRWt99tYipqizXB+3Qe8gpQ91LX6WZ6AWRol:zYiOgsiTjm8lLzV4yks

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4832 wrote to memory of 3272	4832	rundll32.exe	81
PID 4832 wrote to memory of 3272	4832	rundll32.exe	81
PID 4832 wrote to memory of 3272	4832	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\18479a0a722d7346505ac27b20a8c4ea6ac8b087010a6ed02aeb5833c9d9e7ff.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\18479a0a722d7346505ac27b20a8c4ea6ac8b087010a6ed02aeb5833c9d9e7ff.dll,#1
  2⤵
  PID:3272

memory/3272-132-0x0000000000000000-mapping.dmp

Download
memory/3272-133-0x0000000000CD1000-0x0000000000CD5000-memory.dmp

Filesize
16KB

Download