bd2faa8a9ca4d85a7330872c8b071ddca95d0e199d33bfffb1464caa0f34bb3b

Analysis

max time kernel
150s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2023, 19:24

Target

dbghelp.dll
Size

1.2MB
MD5

b4f1c646ae9244ffcd01557f6742983f
SHA1

46e4bba9e9afa6ec4a23cc057cecc2eb62fe9619
SHA256

27c3b426fb7b259be4466b10d80bc8aa0d61b19529bf1949420c8fcc920f7e09
SHA512

b8878164bc41de350189b8a1cb3796479dafba2bff1238de6a5d6bc4c6a24abc3a9699c9586001e2491a35c8a0564590356af1dfdbb4b0dde27d2bb54d714ad2
SSDEEP

12288:vJpPriy6xVDK69gTN1U0zmJGB6eHfecwoxIMrOOPoOzmhETVo2Qm9H3RgwHRhL4G:Rpi/DK69YN1UIWeHasn1DJ32aRhLay5

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4208 wrote to memory of 644	4208	rundll32.exe	85
PID 4208 wrote to memory of 644	4208	rundll32.exe	85
PID 4208 wrote to memory of 644	4208	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dbghelp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4208
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dbghelp.dll,#1
  2⤵
  PID:644