12a97140043e32e3a4f15bb9a17e16692d06c33cd56bb6d497ac6be2c5c02093

Analysis

max time kernel
58s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
15-02-2023 21:27

Target

dll/DLL_ScrollbarControl.dll
Size

53KB
MD5

16ab9bdacdd35134895b8681d25089c0
SHA1

2bbabe81aa0b3e1b6f0b3f44f47ea7c8666b1292
SHA256

b751e0a0c31f31847948003c094d2f0c6024501048ce87f2c2e9274e1a5cc0fc
SHA512

69e98f54abf147ba79a07fb18ed8e800ab72e09cd605ba84ea53de8ce9924a5bdbcb4d03d2c3b922b40ec773f90a8e9f90ded9630d824201cdb88d1667cea05b
SSDEEP

768:cbjeEDd77nO5UUo/ppKcahlluRhyMaYkk5f5UEDAneZNwBrDo4/d:cbjF7O5UUymXQvymkVeZNSoY

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4976 wrote to memory of 4968	4976	rundll32.exe	rundll32.exe
PID 4976 wrote to memory of 4968	4976	rundll32.exe	rundll32.exe
PID 4976 wrote to memory of 4968	4976	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dll\DLL_ScrollbarControl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4976

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dll\DLL_ScrollbarControl.dll,#1
2⤵
PID:4968