50b66de4364913f7f06991416b1501ced8e0dedb3ae684e62490dc984036a646

Analysis

max time kernel
131s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
16-02-2023 21:19

Target

50b66de4364913f7f06991416b1501ced8e0dedb3ae684e62490dc984036a646.dll
Size

712KB
MD5

c0098332e9f89574931d93717f1081f2
SHA1

29867bfe6a8a66f5a576b3217c18e53fff27737f
SHA256

50b66de4364913f7f06991416b1501ced8e0dedb3ae684e62490dc984036a646
SHA512

aaee0af0e0382033c364857b8e7f44b09eed1b9849029236654106caeaf01ffc19a40270214851fbcc366239bacde508e69f4c1930991e6867552cae5300a39f
SSDEEP

12288:4mZyvwDCBT8jCukuWm8yrAZ6DKGIBe9Be4dfSpHYD9YNbY:4JDkkuEX6DUBe9Btd6puYNbY

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 5044 wrote to memory of 4636	5044	rundll32.exe	rundll32.exe
PID 5044 wrote to memory of 4636	5044	rundll32.exe	rundll32.exe
PID 5044 wrote to memory of 4636	5044	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\50b66de4364913f7f06991416b1501ced8e0dedb3ae684e62490dc984036a646.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5044

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\50b66de4364913f7f06991416b1501ced8e0dedb3ae684e62490dc984036a646.dll,#1
2⤵
PID:4636

memory/4636-132-0x0000000000000000-mapping.dmp

Download
memory/4636-133-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download