0ea2e21f1c2bc172a70b037afaf34894516b0e4e9e445863952e9865edd4e1de

Analysis

max time kernel
140s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 00:45

Target

474d4a550c69a1d6829b15538e1a35e7.dll
Size

51KB
MD5

474d4a550c69a1d6829b15538e1a35e7
SHA1

e6bebba91fe6479706ed5750754edd85ba692845
SHA256

0ea2e21f1c2bc172a70b037afaf34894516b0e4e9e445863952e9865edd4e1de
SHA512

409f04015c6e8b1d823e5d6d90a761b56060474dad880e4caf59ca630dc1a990924be6d8bc87d37a0445262d33e590fad5652a0caa96c5e513a97fa6adbb406f
SSDEEP

768:0fM30Tl1K3DKyOhk7B/4xZargXOkpgebbTEYBh4QAHK2h0OjiAlWSPjd0VrON4CE:cG0p1MOfi7B/4PsgXNL3/h0KNgJ6lO6n

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4568 wrote to memory of 4956	4568	rundll32.exe	88
PID 4568 wrote to memory of 4956	4568	rundll32.exe	88
PID 4568 wrote to memory of 4956	4568	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\474d4a550c69a1d6829b15538e1a35e7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4568
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\474d4a550c69a1d6829b15538e1a35e7.dll,#1
  2⤵
  PID:4956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4956 -ip 4956
1⤵
PID:4312

memory/4956-0-0x0000000010000000-0x000000001001F000-memory.dmp

Filesize
124KB

Download
memory/4956-1-0x0000000010000000-0x000000001001F000-memory.dmp

Filesize
124KB

Download