955f5b9be3796f959f148200be80421babc878ae7ab8ba2793261f3e4a3f5e0f

Analysis

max time kernel
90s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
09-06-2023 20:17

Target

955f5b9be3796f959f148200be80421babc878ae7ab8ba2793261f3e4a3f5e0f.dll
Size

378KB
MD5

6766ec13f7e0864a134b8c5a1500cd5c
SHA1

85b2833da819c997970a624625418657a8b261ab
SHA256

955f5b9be3796f959f148200be80421babc878ae7ab8ba2793261f3e4a3f5e0f
SHA512

816aa5d5c8a2f288c5f81435213809f752f758bba98ecc03ce0cbd7720d0fc6bdea699496fc36377d28d2555b78495d9af615da94fc7b7e7fd831e1701620b64
SSDEEP

6144:GfpY4U2Osp5RrYg3xnxKqn9RbLrj0b0TEAuNobzYabZqxHWkGFz/9edKmUB:GPHOsPRsgxxKmv+kuNo3YGZeWIK

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4320 wrote to memory of 3384	4320	rundll32.exe	rundll32.exe
PID 4320 wrote to memory of 3384	4320	rundll32.exe	rundll32.exe
PID 4320 wrote to memory of 3384	4320	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\955f5b9be3796f959f148200be80421babc878ae7ab8ba2793261f3e4a3f5e0f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4320

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\955f5b9be3796f959f148200be80421babc878ae7ab8ba2793261f3e4a3f5e0f.dll,#1
2⤵
PID:3384

memory/3384-133-0x0000000001ED0000-0x0000000002180000-memory.dmp

Filesize
2.7MB

Download
memory/3384-134-0x0000000001ED0000-0x0000000002180000-memory.dmp

Filesize
2.7MB

Download
memory/3384-135-0x0000000001ED0000-0x0000000002011000-memory.dmp

Filesize
1.3MB

Download