339cd5eaa3e23d3f93ea822b4196d829998998df17666fe4845d98da17e9251e

Analysis

max time kernel
78s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
17-03-2023 21:59

Target

339cd5eaa3e23d3f93ea822b4196d829998998df17666fe4845d98da17e9251e.dll
Size

2.1MB
MD5

b8d85d7ec192b43509503d201f58adbd
SHA1

6362ea9a9c845c55df76ce4f665b5c0221490aa4
SHA256

339cd5eaa3e23d3f93ea822b4196d829998998df17666fe4845d98da17e9251e
SHA512

526b91ec9f4fd5e366c6315ebfa898521af06a3e80e9d56d611bf4aeab4af69b5203fea5f3b5008f9bc383ead570a6938b9e62f89a41bedc16ea7db1ff2b7865
SSDEEP

49152:C4tjkjdLQ84Kq5oacDT4YClHRoCCyhhFwAXjSwl9zf6rlF8:C41kj5Q8475oac3XiyyhT3zSi9e8

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3040 wrote to memory of 2812	3040	rundll32.exe	rundll32.exe
PID 3040 wrote to memory of 2812	3040	rundll32.exe	rundll32.exe
PID 3040 wrote to memory of 2812	3040	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\339cd5eaa3e23d3f93ea822b4196d829998998df17666fe4845d98da17e9251e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3040

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\339cd5eaa3e23d3f93ea822b4196d829998998df17666fe4845d98da17e9251e.dll,#1
2⤵
PID:2812

memory/2812-136-0x00000000024D0000-0x0000000002AFF000-memory.dmp

Filesize
6.2MB

Download
memory/2812-137-0x00000000024D0000-0x0000000002AFF000-memory.dmp

Filesize
6.2MB

Download
memory/2812-138-0x00000000024D0000-0x0000000002611000-memory.dmp

Filesize
1.3MB

Download