ac35aa097f4fe607388ff23d470e7982ace67eef8edba7dd6ded8a31db602e17

Analysis

max time kernel
143s
max time network
117s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
02-03-2023 22:02

Target

ac35aa097f4fe607388ff23d470e7982ace67eef8edba7dd6ded8a31db602e17.dll
Size

2.6MB
MD5

f1980c447e2dba3950994d1b8be50552
SHA1

3e02e191e7be8f792a4c0927e8bc31b12b168dd6
SHA256

ac35aa097f4fe607388ff23d470e7982ace67eef8edba7dd6ded8a31db602e17
SHA512

96995c1667aa1aa44841ba508a96f4a819191859b962605e39bd4c059d9f3b9ffd3c6bc98ff27eeef577c405d4d5fbe8a240e989a1872344af5ff16ef2f4b973
SSDEEP

49152:t+dtb26Eb0Xgv8H6qIpP9cGe5NFcWGu0Qpbzr9mb1jLndxa77:Udc6Eb0ZaquB4NnXpbz4xY

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1292 wrote to memory of 868	1292	rundll32.exe	rundll32.exe
PID 1292 wrote to memory of 868	1292	rundll32.exe	rundll32.exe
PID 1292 wrote to memory of 868	1292	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ac35aa097f4fe607388ff23d470e7982ace67eef8edba7dd6ded8a31db602e17.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1292

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ac35aa097f4fe607388ff23d470e7982ace67eef8edba7dd6ded8a31db602e17.dll,#1
2⤵
PID:868

memory/868-133-0x0000000002AF0000-0x0000000003344000-memory.dmp

Filesize
8.3MB

Download
memory/868-134-0x0000000002AF0000-0x0000000003344000-memory.dmp

Filesize
8.3MB

Download