6ec79179c1e61df21e38b754017b672d559f0537ce0a3b64afe7df97025fd01d

Analysis

max time kernel
1685s
max time network
1147s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
10/10/2023, 10:38

Target

DLL/MegaDLL.dll
Size

17KB
MD5

d904120b05f69c04f55f31f4a0c330db
SHA1

5e2c67cd8e0df64372b0f480eaa0bd2318d0af88
SHA256

9c344fc3b74cb0c407941f328817acc14af1958596f514081c22541d125f30b1
SHA512

34c70d7f14751c611a7ee28225535ba18025065a47c545d1cb14a6609ea5f5fe2b5e0e182bb7018d606e3afd2ae5970b1a1ff7b1034278c38949a924378f0f1a
SSDEEP

384:MnW5v2OkC4ksAG3qdDeGpmeyQQ1jtgzQ6jdO0uuokwawAO8wWsKMDc:kW5uOkisqdDBtKyk6jdOAFm

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 760 wrote to memory of 1588	760	rundll32.exe	83
PID 760 wrote to memory of 1588	760	rundll32.exe	83
PID 760 wrote to memory of 1588	760	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DLL\MegaDLL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:760
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\DLL\MegaDLL.dll,#1
  2⤵
  PID:1588

memory/1588-0-0x0000000000B10000-0x0000000000B20000-memory.dmp

Filesize
64KB

Download
memory/1588-1-0x0000000002670000-0x000000000267C000-memory.dmp

Filesize
48KB

Download
memory/1588-3-0x00000000740D0000-0x0000000074880000-memory.dmp

Filesize
7.7MB

Download
memory/1588-2-0x0000000074A10000-0x0000000074A1C000-memory.dmp

Filesize
48KB

Download
memory/1588-5-0x00000000740D0000-0x0000000074880000-memory.dmp

Filesize
7.7MB

Download