9ef5aa420b941cbc0256c9ae361fd81e261cab455b2e691dfbaac76b463c7972

Analysis

max time kernel
111s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
15-02-2023 20:54

Target

9ef5aa420b941cbc0256c9ae361fd81e261cab455b2e691dfbaac76b463c7972.dll
Size

431KB
MD5

1b588a4b292cea64b222c2683f6ebbcd
SHA1

4a359ebb411a883208179671741c315a56531f06
SHA256

9ef5aa420b941cbc0256c9ae361fd81e261cab455b2e691dfbaac76b463c7972
SHA512

3ffeeaaf988cda21f8851ec2e83d0a85cc59f177ce767994397242cb64f2d9c0ab3076ae0b0d1be5cfad328423a8ce7b5c2d0edfcb225f23b2d48a32d5f987cc
SSDEEP

12288:EUBQrIhvpkv8buA2UQ0BUKIRrPwHhT5OgiJLr:EUSrKkvOu8QsIRDAMr

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4820 wrote to memory of 5104	4820	rundll32.exe	rundll32.exe
PID 4820 wrote to memory of 5104	4820	rundll32.exe	rundll32.exe
PID 4820 wrote to memory of 5104	4820	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9ef5aa420b941cbc0256c9ae361fd81e261cab455b2e691dfbaac76b463c7972.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9ef5aa420b941cbc0256c9ae361fd81e261cab455b2e691dfbaac76b463c7972.dll,#1
  2⤵
  PID:5104

memory/5104-132-0x0000000000000000-mapping.dmp

Download
memory/5104-133-0x0000000000400000-0x0000000000709000-memory.dmp

Filesize
3.0MB

Download