b8d2253cf39b8ed8708bc81b3a4a360277eec742f2214ca0e25af552c691ea92

Analysis

max time kernel
127s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2023, 16:44

Target

b8d2253cf39b8ed8708bc81b3a4a360277eec742f2214ca0e25af552c691ea92.dll
Size

2.6MB
MD5

5093c4f8a7a4643af6d40e313a6d8659
SHA1

9b894a73609de7e8ed99019885e60b695f7cf16d
SHA256

b8d2253cf39b8ed8708bc81b3a4a360277eec742f2214ca0e25af552c691ea92
SHA512

c9ff098cba31152c43bf0a4f3ea4296009ad7bdb609395b0d0a8b5802f9a364355f308e7d4b5bf274eeba1d18492ec6f2f02f800a6367e81cff46278dec5611d
SSDEEP

24576:+XFZ26qNun+tz3IZsrJq5IMRIy2jN6zLlqoSIwnnbg2+E8zov9uZ+S4mx/4SQ50:MFMZNULL3vlwB8zD/BQ50

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 4528	2060	rundll32.exe	83
PID 2060 wrote to memory of 4528	2060	rundll32.exe	83
PID 2060 wrote to memory of 4528	2060	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b8d2253cf39b8ed8708bc81b3a4a360277eec742f2214ca0e25af552c691ea92.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b8d2253cf39b8ed8708bc81b3a4a360277eec742f2214ca0e25af552c691ea92.dll,#1
  2⤵
  PID:4528

memory/4528-0-0x0000000010000000-0x0000000010371000-memory.dmp

Filesize
3.4MB

Download
memory/4528-1-0x0000000010000000-0x0000000010371000-memory.dmp

Filesize
3.4MB

Download