317af31af981e9cecbaca70fdd6823a3f138f3e839ef653a9a30e293aac7e024

Analysis

max time kernel
136s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
12-06-2023 20:35

Target

317af31af981e9cecbaca70fdd6823a3f138f3e839ef653a9a30e293aac7e024.dll
Size

830KB
MD5

85e0a2c9bf2ca20697541985eb7f9cb8
SHA1

a5499ece65b2491b71d22dbc560cc683b159cb40
SHA256

317af31af981e9cecbaca70fdd6823a3f138f3e839ef653a9a30e293aac7e024
SHA512

f2e3eb56e4f3712f2e01172ea0e4120f0ecc6f161cb2b0e313edf85300b256592ef04d4378a3647ca5e2ec4bf27d4a5a98bde7fd75ce0e5de714169049a69996
SSDEEP

12288:R+lxCOdLxdDMSPdBY8stKKAWnhUdLONXn6IaluGUhbN73MLvCqwEUQf9K67Zmq6f:R8TxMFFtKK7udL46IbGUH3efHX7AA7p

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 808 wrote to memory of 4860	808	rundll32.exe	rundll32.exe
PID 808 wrote to memory of 4860	808	rundll32.exe	rundll32.exe
PID 808 wrote to memory of 4860	808	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\317af31af981e9cecbaca70fdd6823a3f138f3e839ef653a9a30e293aac7e024.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:808

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\317af31af981e9cecbaca70fdd6823a3f138f3e839ef653a9a30e293aac7e024.dll,#1
2⤵
PID:4860

memory/4860-133-0x00000000029D0000-0x0000000002E87000-memory.dmp

Filesize
4.7MB

Download
memory/4860-134-0x00000000029D0000-0x0000000002E87000-memory.dmp

Filesize
4.7MB

Download
memory/4860-135-0x00000000029D0000-0x0000000002B11000-memory.dmp

Filesize
1.3MB

Download