28cc402d0a76d35546dbfe0896db2e6ee162b5678346401c9b1f0e7e990aba80

Analysis

max time kernel
138s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
18/09/2022, 23:25

Target

28cc402d0a76d35546dbfe0896db2e6ee162b5678346401c9b1f0e7e990aba80.dll
Size

33KB
MD5

f05ef8c47e91433390865e2c21e3fe5c
SHA1

ae15f28dfa7a0cfe6647f7a1f25a309fed284f91
SHA256

28cc402d0a76d35546dbfe0896db2e6ee162b5678346401c9b1f0e7e990aba80
SHA512

fb3b752288f6a7e7f21657ce7fbca7ed24a04defb49716b278bb5a41daab4ad12b02f24fb66bbe47d7996778054fb7fada5e4efe7d751973fd236f7d9da08c3a
SSDEEP

384:B4aelN9qFu9W3v2DT/2yZNFHuBsv6r8LfuN77t4qhNZDt3ICawCJvp9MRZHr2P:B4rlH9yQ2yFOB0Ry7COMChwB9MR8P

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 4956	2472	rundll32.exe	82
PID 2472 wrote to memory of 4956	2472	rundll32.exe	82
PID 2472 wrote to memory of 4956	2472	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\28cc402d0a76d35546dbfe0896db2e6ee162b5678346401c9b1f0e7e990aba80.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\28cc402d0a76d35546dbfe0896db2e6ee162b5678346401c9b1f0e7e990aba80.dll,#1
  2⤵
  PID:4956