1d9fc5d9a09d084de645d662a71783b75bcd0c80345f5d28bde2a8117e135fef

Analysis

max time kernel
285s
max time network
318s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
10-02-2023 20:02

Target

1d9fc5d9a09d084de645d662a71783b75bcd0c80345f5d28bde2a8117e135fef.dll
Size

125KB
MD5

47a3a6afc629c04883a277c8946bc336
SHA1

afefccea85e572bb9352a873faa7acd2753e488e
SHA256

1d9fc5d9a09d084de645d662a71783b75bcd0c80345f5d28bde2a8117e135fef
SHA512

d8283d6e421bf7cbb6e547a9a1ea7ab92c005977eb498fe080f742eafce6bcb929c094314e3fff3772d5e0bc78e687b499a3fa8398f342e9d36617cbf84b0ae8
SSDEEP

3072:iBpjilnnKkzwdeodCuXMRFaPj+2RqDazmmRBH6LlN:OpaKQwRdO7N2w2zLS

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3724 wrote to memory of 3700	3724	rundll32.exe	rundll32.exe
PID 3724 wrote to memory of 3700	3724	rundll32.exe	rundll32.exe
PID 3724 wrote to memory of 3700	3724	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1d9fc5d9a09d084de645d662a71783b75bcd0c80345f5d28bde2a8117e135fef.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3724

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1d9fc5d9a09d084de645d662a71783b75bcd0c80345f5d28bde2a8117e135fef.dll,#1
2⤵
PID:3700

memory/3700-132-0x0000000000000000-mapping.dmp

Download
memory/3700-133-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download