df7e04272d2a0e6bdff92e8c965ae5560f53f0e7dbd1bc278f3169a16439337e

Analysis

max time kernel
126s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
17-02-2023 19:52

Target

df7e04272d2a0e6bdff92e8c965ae5560f53f0e7dbd1bc278f3169a16439337e.dll
Size

250KB
MD5

77cf42324e00af3f547b70644e8eab2a
SHA1

7a2b9358062f36b701d120b901e1673404724b2d
SHA256

df7e04272d2a0e6bdff92e8c965ae5560f53f0e7dbd1bc278f3169a16439337e
SHA512

41e3163361a0064bb953bacbe1a2d4847d3b6bd7cff8791d2f4119ce62bce025f6b7a47ee87058708e243c30e83774418b4e67ff03808e24231e4b45d60fbff7
SSDEEP

6144:8TFpXVgcyOYtDPv/DRshwp5N0iV2Hl7MywPF1v:mplgPpv/9ZDQl

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1036 wrote to memory of 4760	1036	rundll32.exe	rundll32.exe
PID 1036 wrote to memory of 4760	1036	rundll32.exe	rundll32.exe
PID 1036 wrote to memory of 4760	1036	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\df7e04272d2a0e6bdff92e8c965ae5560f53f0e7dbd1bc278f3169a16439337e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1036

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\df7e04272d2a0e6bdff92e8c965ae5560f53f0e7dbd1bc278f3169a16439337e.dll,#1
2⤵
PID:4760

memory/4760-132-0x0000000000000000-mapping.dmp

Download
memory/4760-133-0x0000000002920000-0x0000000002A62000-memory.dmp

Filesize
1.3MB

Download
memory/4760-134-0x0000000002920000-0x0000000002A62000-memory.dmp

Filesize
1.3MB

Download
memory/4760-135-0x0000000002920000-0x0000000002A61000-memory.dmp

Filesize
1.3MB

Download