9537e206f93610475ce13e7053a849cee04a322957fddd476c437ea47c2153a4

Analysis

max time kernel
105s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
21-06-2023 21:56

Target

9537e206f93610475ce13e7053a849cee04a322957fddd476c437ea47c2153a4.dll
Size

682KB
MD5

f2dfa715a632848df3c09b72d2bf9b3c
SHA1

18828f5e249ed152e0c34b50206fa73c2331a899
SHA256

9537e206f93610475ce13e7053a849cee04a322957fddd476c437ea47c2153a4
SHA512

82538a953778d1eb4748f1b78ee939024fbd318997f08f50f6d41ac6b74376f2fa29d7d6d755f2350e4e86462f1b74576ad166dec0b236f92842375cf00d7c32
SSDEEP

12288:+zNileMlN7QF4L4X8cXdIaZ1CouO2EJrxZmaA:+zNkkDX0cOa

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4780 wrote to memory of 4520	4780	rundll32.exe	rundll32.exe
PID 4780 wrote to memory of 4520	4780	rundll32.exe	rundll32.exe
PID 4780 wrote to memory of 4520	4780	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9537e206f93610475ce13e7053a849cee04a322957fddd476c437ea47c2153a4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4780

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9537e206f93610475ce13e7053a849cee04a322957fddd476c437ea47c2153a4.dll,#1
2⤵
PID:4520

memory/4520-133-0x0000000002120000-0x00000000023A9000-memory.dmp

Filesize
2.5MB

Download