667ec7cb8631205e4046dd694dd4e08a27f4a75b6e5765f97c08aa409261e799

Analysis

max time kernel
53s
max time network
74s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
22-06-2023 20:12

Target

667ec7cb8631205e4046dd694dd4e08a27f4a75b6e5765f97c08aa409261e799.dll
Size

430KB
MD5

4455c3c54aaa646fb4ff1896cb08fde4
SHA1

52b1b6429fc4e84d65e7e4e700cca96faa8e332c
SHA256

667ec7cb8631205e4046dd694dd4e08a27f4a75b6e5765f97c08aa409261e799
SHA512

0a06fea8161352398114d162813b71384b968bc1a776c150a57a5623e5ccfd338bf7348f02c8fba172cc6a03c158a2631f53e84633eb4ae3912650fcf9db894f
SSDEEP

12288:wMClQDsktgT+YvAh+S+ez+8yOc2RqXcY5YEd4DM6:wMClnke+zhJ+dxF

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2144 wrote to memory of 4572	2144	rundll32.exe	rundll32.exe
PID 2144 wrote to memory of 4572	2144	rundll32.exe	rundll32.exe
PID 2144 wrote to memory of 4572	2144	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\667ec7cb8631205e4046dd694dd4e08a27f4a75b6e5765f97c08aa409261e799.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2144

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\667ec7cb8631205e4046dd694dd4e08a27f4a75b6e5765f97c08aa409261e799.dll,#1
2⤵
PID:4572

memory/4572-133-0x0000000002B20000-0x0000000002E21000-memory.dmp

Filesize
3.0MB

Download
memory/4572-134-0x0000000002B20000-0x0000000002E21000-memory.dmp

Filesize
3.0MB

Download
memory/4572-135-0x0000000002B20000-0x0000000002C61000-memory.dmp

Filesize
1.3MB

Download