052cd394d318dfe549cfad25d490d6af9647b0719a3980e5dddfc95edcdfd9c0

Analysis

max time kernel
78s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2024, 19:57

Target

052cd394d318dfe549cfad25d490d6af9647b0719a3980e5dddfc95edcdfd9c0.dll
Size

2.1MB
MD5

7d2d18b52bbf3f3f52e42d10bae08cd0
SHA1

f0c18d1402a3cd75f42a50b8e8feeb0717a30fb5
SHA256

052cd394d318dfe549cfad25d490d6af9647b0719a3980e5dddfc95edcdfd9c0
SHA512

048869df54a066247b93fe20eefee0e3fea470e3752a1adf53e1bcfbaf584f9a5b1b0b84c6a862ac6a9dca781edbd4e9bd095ada2c357d1202e2c60de7381f3a
SSDEEP

49152:KofQOhjGRWH/jOYaRtYDvCg+SkDDN9CCTTU:xfz5u4OZ+23DiCc

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3500 wrote to memory of 4628	3500	rundll32.exe	80
PID 3500 wrote to memory of 4628	3500	rundll32.exe	80
PID 3500 wrote to memory of 4628	3500	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\052cd394d318dfe549cfad25d490d6af9647b0719a3980e5dddfc95edcdfd9c0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3500
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\052cd394d318dfe549cfad25d490d6af9647b0719a3980e5dddfc95edcdfd9c0.dll,#1
  2⤵
  PID:4628

memory/4628-2-0x0000000002510000-0x0000000002516000-memory.dmp

Filesize
24KB

Download
memory/4628-0-0x0000000010000000-0x0000000010212000-memory.dmp

Filesize
2.1MB

Download
memory/4628-3-0x0000000002650000-0x0000000002766000-memory.dmp

Filesize
1.1MB

Download
memory/4628-4-0x0000000002780000-0x000000000287C000-memory.dmp

Filesize
1008KB

Download
memory/4628-7-0x0000000002780000-0x000000000287C000-memory.dmp

Filesize
1008KB

Download
memory/4628-8-0x0000000010000000-0x0000000010212000-memory.dmp

Filesize
2.1MB

Download
memory/4628-11-0x0000000002780000-0x000000000287C000-memory.dmp

Filesize
1008KB

Download
memory/4628-13-0x0000000004720000-0x000000000480D000-memory.dmp

Filesize
948KB

Download
memory/4628-12-0x0000000002880000-0x000000000471C000-memory.dmp

Filesize
30.6MB

Download
memory/4628-14-0x0000000004810000-0x0000000004907000-memory.dmp

Filesize
988KB

Download
memory/4628-17-0x0000000004810000-0x0000000004907000-memory.dmp

Filesize
988KB

Download
memory/4628-18-0x0000000000550000-0x0000000000552000-memory.dmp

Filesize
8KB

Download
memory/4628-19-0x0000000026740000-0x0000000026744000-memory.dmp

Filesize
16KB

Download