4f13d35180b85261aa49bd280ae52c6ff501fcc224ecd8ff729697337e14ce14

Analysis

max time kernel
90s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
08-09-2022 12:18

Target

4f13d35180b85261aa49bd280ae52c6ff501fcc224ecd8ff729697337e14ce14.dll
Size

598KB
MD5

da51dd657868bf4d2924b4398e045b27
SHA1

2eca78e78bdc00e02da0a7328a3c57176cf3c011
SHA256

4f13d35180b85261aa49bd280ae52c6ff501fcc224ecd8ff729697337e14ce14
SHA512

ca168c81ebec1de5ffdcb9b766af4c4c4ae42e3a0c49e82c04bc8e9b31fdb30594b6df12a7f3ecddf0d73a352326e8ebd3265caae152bf2d67409b5f3759b1e8
SSDEEP

12288:hzF6eBVYHBQ3DvlYuZ+wNvYyujPt5ABJXT+gO:ho1HBuKuj61D4XTK

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4008 wrote to memory of 4492	4008	rundll32.exe	rundll32.exe
PID 4008 wrote to memory of 4492	4008	rundll32.exe	rundll32.exe
PID 4008 wrote to memory of 4492	4008	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4f13d35180b85261aa49bd280ae52c6ff501fcc224ecd8ff729697337e14ce14.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4008

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4f13d35180b85261aa49bd280ae52c6ff501fcc224ecd8ff729697337e14ce14.dll,#1
2⤵
PID:4492