5edbdaeb5f7b692e3cc8b051c44bfb84ea4d2dac4d30ec5fc0866669ddc81d80

Analysis

max time kernel
99s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
17-03-2023 22:00

Target

5edbdaeb5f7b692e3cc8b051c44bfb84ea4d2dac4d30ec5fc0866669ddc81d80.dll
Size

2.0MB
MD5

14c154cdf50fa61941406ab3108b405b
SHA1

08e7d23cecc3560d9efbbd540a5428a587bb1531
SHA256

5edbdaeb5f7b692e3cc8b051c44bfb84ea4d2dac4d30ec5fc0866669ddc81d80
SHA512

eea68b90703690b6b8571c78043e0d65012f4613b5230dbb2c9160ab9963022dd29923e3a3cd646157daf0af59f42ca7be689cc6b774c0da71e7fd491f12a185
SSDEEP

49152:AedbI0oDAWZ+lBUFPsvRp9NGO3/tUvFyCGvR:Ak5pdlBU0aO3/8kn

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4124 wrote to memory of 3964	4124	rundll32.exe	rundll32.exe
PID 4124 wrote to memory of 3964	4124	rundll32.exe	rundll32.exe
PID 4124 wrote to memory of 3964	4124	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5edbdaeb5f7b692e3cc8b051c44bfb84ea4d2dac4d30ec5fc0866669ddc81d80.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4124

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5edbdaeb5f7b692e3cc8b051c44bfb84ea4d2dac4d30ec5fc0866669ddc81d80.dll,#1
2⤵
PID:3964

memory/3964-133-0x0000000002680000-0x0000000002C88000-memory.dmp

Filesize
6.0MB

Download
memory/3964-134-0x0000000002680000-0x0000000002C88000-memory.dmp

Filesize
6.0MB

Download
memory/3964-135-0x0000000002680000-0x00000000027C1000-memory.dmp

Filesize
1.3MB

Download