8a2bb36ea9171bea14f14b79e564717f481d09107888bf172788d7276945c817

Analysis

max time kernel
62s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
29-03-2023 10:14

Target

8a2bb36ea9171bea14f14b79e564717f481d09107888bf172788d7276945c817.dll
Size

2.1MB
MD5

0c086e0c8f80733ddf36c12fe1c5e7fa
SHA1

1dc7bf64e6b2f415100c16c445118531c55458ca
SHA256

8a2bb36ea9171bea14f14b79e564717f481d09107888bf172788d7276945c817
SHA512

13bff62d0b7dbb20ed5db327421900769cc0b8d480c857ea1d63e69b7f4461b51fe7fd02c07062058bca04f6dac92cd32073d64f820adef008c66a86440d433f
SSDEEP

49152:5sOCiKQTEnsLEXiZWK1Ug3iMZE2JrqmRAIB5OON5mVnwP2xJ6ycbSE5eiAUl:5fiCE9K5yIA0LmVnwO76BHF

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1640 wrote to memory of 4120	1640	rundll32.exe	rundll32.exe
PID 1640 wrote to memory of 4120	1640	rundll32.exe	rundll32.exe
PID 1640 wrote to memory of 4120	1640	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8a2bb36ea9171bea14f14b79e564717f481d09107888bf172788d7276945c817.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8a2bb36ea9171bea14f14b79e564717f481d09107888bf172788d7276945c817.dll,#1
  2⤵
  PID:4120

memory/4120-133-0x0000000000400000-0x0000000000A23000-memory.dmp

Filesize
6.1MB

Download