c48bb241122a3a332ca0b9841380d6304aac3aa999d9137a5826d4e26f2c16f1

Analysis

max time kernel
94s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
01-04-2023 18:49

Target

c48bb241122a3a332ca0b9841380d6304aac3aa999d9137a5826d4e26f2c16f1.dll
Size

799KB
MD5

d66f96c85c798ef229defab01069a548
SHA1

b4dde000ff0b07b5512460ab8f512771ce443bab
SHA256

c48bb241122a3a332ca0b9841380d6304aac3aa999d9137a5826d4e26f2c16f1
SHA512

731bd07a1249f255c8ef86db2125f34b40a3577fa028e3a802b27d3e1c3ba06494bc901b91a801de1f3becf85e63e93b2377fe43eebfa77f993f1c3a0575ce6d
SSDEEP

24576:VZsNaBlJPQfxIjusVYbFP1VWSFEb/r96Zynyz/78Aqu:V9lJPQf4YbhOZx61T

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2856 wrote to memory of 1912	2856	rundll32.exe	rundll32.exe
PID 2856 wrote to memory of 1912	2856	rundll32.exe	rundll32.exe
PID 2856 wrote to memory of 1912	2856	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c48bb241122a3a332ca0b9841380d6304aac3aa999d9137a5826d4e26f2c16f1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c48bb241122a3a332ca0b9841380d6304aac3aa999d9137a5826d4e26f2c16f1.dll,#1
  2⤵
  PID:1912

memory/1912-133-0x0000000002340000-0x000000000259B000-memory.dmp

Filesize
2.4MB

Download