1efd6d181d0d4911203fab70eaaad753e10e4653b94ad325c6dd085b5b1fcf2f

Analysis

max time kernel
148s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
18-09-2022 23:28

Target

1efd6d181d0d4911203fab70eaaad753e10e4653b94ad325c6dd085b5b1fcf2f.dll
Size

41KB
MD5

3f39e11675605940de5b2669fa67dbdb
SHA1

d4937bd76cf1f7c2704d82bd4cc69a3c587f16f7
SHA256

1efd6d181d0d4911203fab70eaaad753e10e4653b94ad325c6dd085b5b1fcf2f
SHA512

e07cb6f8f003d3938ce1f4093ae8212bbfeddb396167b1c8b3905747dcea91d0a26488074f03965b7d34f2ef914fb26109f462be11fde4e5717809db91f7edf2
SSDEEP

384:yjlbqr/fxQ0M9c9XNFtgHw36jYg2IIC3G974sD/77quBFdAAg+awpJKRkWXypTCW:mqbpQ0nPK6ID3Gj/7Hh2+hP6kWBJRoP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 1212	2412	rundll32.exe	85
PID 2412 wrote to memory of 1212	2412	rundll32.exe	85
PID 2412 wrote to memory of 1212	2412	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1efd6d181d0d4911203fab70eaaad753e10e4653b94ad325c6dd085b5b1fcf2f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1efd6d181d0d4911203fab70eaaad753e10e4653b94ad325c6dd085b5b1fcf2f.dll,#1
  2⤵
  PID:1212