0bba215454262acfe65080fbb60feede65c5847a649f7335fe6b76d8bd744ab7

Analysis

max time kernel
91s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
12-02-2023 19:05

Target

0bba215454262acfe65080fbb60feede65c5847a649f7335fe6b76d8bd744ab7.dll
Size

1.9MB
MD5

13cd2e056feaeaad728ceebe5afbf1cf
SHA1

97c6eaaaa13beaef8fe6c2dd4d278eca0ca4a77e
SHA256

0bba215454262acfe65080fbb60feede65c5847a649f7335fe6b76d8bd744ab7
SHA512

97753991e92639cb3f3db08cf2a4439315d05d5ec4f367ba9d9da417fc23288301594261deb1e86400cb26e431c58c42571c95855e33eda3e57bc23aaa611ed5
SSDEEP

49152:FS8EBxM6azpOrHwGqInbFcJxigZbzl9+TH7:FS8EBx3CwrQGqIbgxfoH7

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2300 wrote to memory of 2116	2300	rundll32.exe	rundll32.exe
PID 2300 wrote to memory of 2116	2300	rundll32.exe	rundll32.exe
PID 2300 wrote to memory of 2116	2300	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0bba215454262acfe65080fbb60feede65c5847a649f7335fe6b76d8bd744ab7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2300

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0bba215454262acfe65080fbb60feede65c5847a649f7335fe6b76d8bd744ab7.dll,#1
2⤵
PID:2116

memory/2116-132-0x0000000000000000-mapping.dmp

Download
memory/2116-133-0x00000000752F0000-0x0000000075913000-memory.dmp

Filesize
6.1MB

Download