29007df6ca40075a0f1be9f7468f60d84eb420cc16706e3c2bc58f557b302cbb

Analysis

max time kernel
144s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
18-09-2022 23:21

Target

29007df6ca40075a0f1be9f7468f60d84eb420cc16706e3c2bc58f557b302cbb.dll
Size

36KB
MD5

d214b69c8d03f97ef44f1d6d4953bc34
SHA1

f463b513b4a3ff35068b9f04f83ec33586576c5f
SHA256

29007df6ca40075a0f1be9f7468f60d84eb420cc16706e3c2bc58f557b302cbb
SHA512

ea74c39be61068c73059a385074d376467552adea858586b7451ffdb968d463c44c16ebcdbdae74f2945624b15c009ff36bc20173412b776c0567de0f0f4db4c
SSDEEP

768:nT1BNCkK5gVGxlaZql9J1oT1cIg7/fO3+a5hCDKR4plx85/t:TnNCl5X/J12y5736+4QWR4pzUV

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5072 wrote to memory of 648	5072	rundll32.exe	83
PID 5072 wrote to memory of 648	5072	rundll32.exe	83
PID 5072 wrote to memory of 648	5072	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\29007df6ca40075a0f1be9f7468f60d84eb420cc16706e3c2bc58f557b302cbb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\29007df6ca40075a0f1be9f7468f60d84eb420cc16706e3c2bc58f557b302cbb.dll,#1
  2⤵
  PID:648