c0d3487e8c75f58e42c41c0d50f422b7ecdd4521f45a10073cd4df116d55c581

Analysis

max time kernel
93s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
30-05-2023 00:19

Target

c0d3487e8c75f58e42c41c0d50f422b7ecdd4521f45a10073cd4df116d55c581.dll
Size

237KB
MD5

e0daf8e632f25436fc21a904d3c39cf8
SHA1

ea08415ebedd8c7555a9ba7286c2182bac9b59ac
SHA256

c0d3487e8c75f58e42c41c0d50f422b7ecdd4521f45a10073cd4df116d55c581
SHA512

95c385122b8182c4a1bd29e401c4c70c32d12e8bb523fed2fb05aeb66271c36870ed0690b75a1896a01617b8866358a7623a6dcf84c0938133b1bc3311f9579b
SSDEEP

3072:o5/1GRcjcdzfeEU6oit+L8CRQCreWcJgHYngOxzzkECy/AQ09lTTjn5bUY:ouHdzfSR8krWnbxHrCI0Hj5b

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4928 wrote to memory of 1204	4928	rundll32.exe	rundll32.exe
PID 4928 wrote to memory of 1204	4928	rundll32.exe	rundll32.exe
PID 4928 wrote to memory of 1204	4928	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c0d3487e8c75f58e42c41c0d50f422b7ecdd4521f45a10073cd4df116d55c581.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4928

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c0d3487e8c75f58e42c41c0d50f422b7ecdd4521f45a10073cd4df116d55c581.dll,#1
2⤵
PID:1204

memory/1204-133-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download