0704385a48d833beabde635b5f945561670cb220c13c10a7f3dd963442fc4107

Analysis

max time kernel
140s
max time network
55s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
25-06-2023 19:49

Target

0704385a48d833beabde635b5f945561670cb220c13c10a7f3dd963442fc4107.dll
Size

1.8MB
MD5

6f3aff08035d58e462f291644b9b2f78
SHA1

3d3f8907a95b49c967d1cdc8f048b21812c3a08f
SHA256

0704385a48d833beabde635b5f945561670cb220c13c10a7f3dd963442fc4107
SHA512

f422a9a9deb6db932e150cc82cea3c66ea56e759d31229413951cd1fc8d2bdb784a6d74c65b18529e15297dd1207fb5c99360e322f4d9e2b41dad339ddb45f31
SSDEEP

49152:56Zb5PMbnqbFcJxigZbCkJgMaqjYkAble5gLJTH7oi:56V5PMbnAgx2VAAblWOhH7oi

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1808 wrote to memory of 4496	1808	rundll32.exe	rundll32.exe
PID 1808 wrote to memory of 4496	1808	rundll32.exe	rundll32.exe
PID 1808 wrote to memory of 4496	1808	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0704385a48d833beabde635b5f945561670cb220c13c10a7f3dd963442fc4107.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1808

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0704385a48d833beabde635b5f945561670cb220c13c10a7f3dd963442fc4107.dll,#1
2⤵
PID:4496

memory/4496-133-0x0000000075060000-0x00000000753ED000-memory.dmp

Filesize
3.6MB

Download
memory/4496-135-0x0000000002DF0000-0x0000000002DF1000-memory.dmp

Filesize
4KB

Download
memory/4496-134-0x0000000002CE0000-0x0000000002D2B000-memory.dmp

Filesize
300KB

Download
memory/4496-136-0x0000000002F30000-0x0000000002F31000-memory.dmp

Filesize
4KB

Download
memory/4496-137-0x0000000002DB0000-0x0000000002DB1000-memory.dmp

Filesize
4KB

Download
memory/4496-138-0x0000000002F40000-0x0000000002F41000-memory.dmp

Filesize
4KB

Download
memory/4496-139-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/4496-140-0x0000000002F10000-0x0000000002F11000-memory.dmp

Filesize
4KB

Download
memory/4496-141-0x0000000002DC0000-0x0000000002DC1000-memory.dmp

Filesize
4KB

Download
memory/4496-142-0x0000000003450000-0x0000000003452000-memory.dmp

Filesize
8KB

Download
memory/4496-143-0x0000000075060000-0x00000000753ED000-memory.dmp

Filesize
3.6MB

Download
memory/4496-144-0x0000000002CE0000-0x0000000002D2B000-memory.dmp

Filesize
300KB

Download