cb6330dea1701a43d4bdb9a32c89d2702786dbbff11e789480f2524aea27efb1

Analysis

max time kernel
168s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 10:50

Target

18757aad84f0f4c168e3f3073cd9bb84.dll
Size

37KB
MD5

18757aad84f0f4c168e3f3073cd9bb84
SHA1

b170f55b945ab7641506fc73d639444d6e662560
SHA256

cb6330dea1701a43d4bdb9a32c89d2702786dbbff11e789480f2524aea27efb1
SHA512

d2de1886d496357de30abd4f0969de5a7b09d2719a8faf961f843fbea390077a494f5d4a676d5fbd7ef9ada292ae8ff7906a798565f65da3c5cc5301e04ef885
SSDEEP

768:X3tPjOD36nmRqlY02mfPAAcQxqzG/eNTWcL:X3QOyAfPpcJL

Score

1^/10

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4356 wrote to memory of 4868	4356	rundll32.exe	88
PID 4356 wrote to memory of 4868	4356	rundll32.exe	88
PID 4356 wrote to memory of 4868	4356	rundll32.exe	88
PID 4868 wrote to memory of 640	4868	rundll32.exe	92
PID 4868 wrote to memory of 640	4868	rundll32.exe	92
PID 4868 wrote to memory of 640	4868	rundll32.exe	92
PID 640 wrote to memory of 4448	640	net.exe	94
PID 640 wrote to memory of 4448	640	net.exe	94
PID 640 wrote to memory of 4448	640	net.exe	94
PID 4868 wrote to memory of 2372	4868	rundll32.exe	95
PID 4868 wrote to memory of 2372	4868	rundll32.exe	95
PID 4868 wrote to memory of 2372	4868	rundll32.exe	95
PID 2372 wrote to memory of 1636	2372	net.exe	97
PID 2372 wrote to memory of 1636	2372	net.exe	97
PID 2372 wrote to memory of 1636	2372	net.exe	97

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\18757aad84f0f4c168e3f3073cd9bb84.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4356
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\18757aad84f0f4c168e3f3073cd9bb84.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4868
- - C:\Windows\SysWOW64\net.exe
    net stop winss
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:640
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop winss
      4⤵
      PID:4448
- - C:\Windows\SysWOW64\net.exe
    net stop OcHealthMon
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2372
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop OcHealthMon
      4⤵
      PID:1636

memory/4868-0-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/4868-1-0x0000000000C80000-0x0000000000C85000-memory.dmp

Filesize
20KB

Download
memory/4868-2-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/4868-3-0x0000000000C80000-0x0000000000C85000-memory.dmp

Filesize
20KB

Download