561fb96076be4a9d4444e863cc3f26e9063824d215043e899539790a33c0ba50

Analysis

max time kernel
123s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
20-02-2023 18:44

Target

561fb96076be4a9d4444e863cc3f26e9063824d215043e899539790a33c0ba50.dll
Size

716KB
MD5

ad78efcda05ed9d4e84e2df07538e2e8
SHA1

0903fd5b63ce2e71e253e3ab6ad17b744ed5b2c0
SHA256

561fb96076be4a9d4444e863cc3f26e9063824d215043e899539790a33c0ba50
SHA512

98f5787aa02fcee15d2805f4b376ef00b7206d81de92bc83695560a561c44936175877e5a8bd890607190d22d956e5e757e61b1ff15d7f5a42dfdd6443bcd4a7
SSDEEP

12288:qlsWn4wkudMYAWIcyam6u6AJrRWxqsMQ9cvb1YuV/CTTG2oz8CbzPJHD:qimiuyYAWINaZu6AxUxXMQyvb1z/CTTW

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4364 wrote to memory of 2912	4364	rundll32.exe	rundll32.exe
PID 4364 wrote to memory of 2912	4364	rundll32.exe	rundll32.exe
PID 4364 wrote to memory of 2912	4364	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\561fb96076be4a9d4444e863cc3f26e9063824d215043e899539790a33c0ba50.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4364

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\561fb96076be4a9d4444e863cc3f26e9063824d215043e899539790a33c0ba50.dll,#1
2⤵
PID:2912

memory/2912-133-0x0000000000400000-0x000000000066E000-memory.dmp

Filesize
2.4MB

Download
memory/2912-134-0x0000000000400000-0x000000000066E000-memory.dmp

Filesize
2.4MB

Download
memory/2912-135-0x0000000000400000-0x000000000066E000-memory.dmp

Filesize
2.4MB

Download
memory/2912-136-0x0000000000400000-0x000000000066E000-memory.dmp

Filesize
2.4MB

Download