170fa3692896e87d91cf221cfadebc056f5255f52c454ceb7c9f41696c07ea0d

Analysis

max time kernel
135s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
12-06-2023 20:48

Target

170fa3692896e87d91cf221cfadebc056f5255f52c454ceb7c9f41696c07ea0d.dll
Size

695KB
MD5

d2413ee153ed88e3ea45518a27775306
SHA1

381189246f13bea527e2654f394b9df98d7816de
SHA256

170fa3692896e87d91cf221cfadebc056f5255f52c454ceb7c9f41696c07ea0d
SHA512

08c4729d0e53dd87f7729c502b71dd8137b232424c52b4603c262ff62ad73c88e337a0f4cb5b49fea99180ec0a0590e244da2f797363c4fa40716de2ce8371bf
SSDEEP

12288:9SCX0YI+/K9mwGk7H7WDPsPOYA14yu0fiWv/KYmp8nZkuDal0/WRiZf:9ShWeekzqLgVWv/Y4HDaEfZ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3700 wrote to memory of 2864	3700	rundll32.exe	rundll32.exe
PID 3700 wrote to memory of 2864	3700	rundll32.exe	rundll32.exe
PID 3700 wrote to memory of 2864	3700	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\170fa3692896e87d91cf221cfadebc056f5255f52c454ceb7c9f41696c07ea0d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3700

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\170fa3692896e87d91cf221cfadebc056f5255f52c454ceb7c9f41696c07ea0d.dll,#1
2⤵
PID:2864

memory/2864-133-0x00000000026D0000-0x0000000002A25000-memory.dmp

Filesize
3.3MB

Download