64204358a29816be54d47deafdd1b62b46c8ecf9468fa76740f0f8ee61ce9e14

Analysis

max time kernel
133s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
16-08-2023 15:39

Target

64204358a29816be54d47deafdd1b62b46c8ecf9468fa76740f0f8ee61ce9e14.dll
Size

332KB
MD5

a120c1e674773d68f4899574453c1186
SHA1

531c779ccc3dfaf8f530b0bb07ae96152a686437
SHA256

64204358a29816be54d47deafdd1b62b46c8ecf9468fa76740f0f8ee61ce9e14
SHA512

56741d785561766b72a95dd2ffed0998443660cc08141f2758561f2fe972e5367fcaca54c7f3d8b046b671716b3d2dfbbbb097d519949c96319dc183c445c3e6
SSDEEP

6144:f/PjuTnYeUokl4BY93jAxEWv1gmpM/66RgMG7uKIT9:f/cc4BNgmf6R5Gt4

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 1520	2212	rundll32.exe	82
PID 2212 wrote to memory of 1520	2212	rundll32.exe	82
PID 2212 wrote to memory of 1520	2212	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\64204358a29816be54d47deafdd1b62b46c8ecf9468fa76740f0f8ee61ce9e14.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\64204358a29816be54d47deafdd1b62b46c8ecf9468fa76740f0f8ee61ce9e14.dll,#1
  2⤵
  PID:1520

memory/1520-133-0x0000000000810000-0x0000000000868000-memory.dmp

Filesize
352KB

Download