93817b15624c672bb84d09bec2b8c783206bdb160f06ec93cea2dc9d27e1857b

Analysis

max time kernel
91s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
16-02-2023 21:01

Target

93817b15624c672bb84d09bec2b8c783206bdb160f06ec93cea2dc9d27e1857b.dll
Size

498KB
MD5

09271165a3b1e31d7a5a8043b01793ea
SHA1

69a3a9b47f7658cff9cff449197f23c77e8fcd69
SHA256

93817b15624c672bb84d09bec2b8c783206bdb160f06ec93cea2dc9d27e1857b
SHA512

b50bfb4989508f59d8ecdfed60cccaa03b930ecdef731b89e93d72ac5f00d1df45d9f027d87ededcdffe6a0dd0447a0f8420368c5fc0332ce4d1eae2761e0fff
SSDEEP

6144:SI8DG5XyfKX7OXgneGKO7B6n2G/ZGRYjjGiW5Covw8uBPR3nXH3nI4oYI4oYI4ou:SPnyXxnfKuB+GRYjjGBU8s4YID+T7UM

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4308 wrote to memory of 456	4308	rundll32.exe	rundll32.exe
PID 4308 wrote to memory of 456	4308	rundll32.exe	rundll32.exe
PID 4308 wrote to memory of 456	4308	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\93817b15624c672bb84d09bec2b8c783206bdb160f06ec93cea2dc9d27e1857b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4308

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\93817b15624c672bb84d09bec2b8c783206bdb160f06ec93cea2dc9d27e1857b.dll,#1
2⤵
PID:456

memory/456-132-0x0000000000000000-mapping.dmp

Download
memory/456-133-0x0000000000400000-0x00000000006FD000-memory.dmp

Filesize
3.0MB

Download