22db7941124dadd534c161d62dc8d55edafe4a4be98c2a98bd699ce1782cdf0e

Analysis

max time kernel
131s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 10:11

Target

22db7941124dadd534c161d62dc8d55edafe4a4be98c2a98bd699ce1782cdf0e.dll
Size

17KB
MD5

2e2a01888b143fc25c7fd3851602c674
SHA1

c4a77193cfe2b56d7e244d8be392ce6596aa8125
SHA256

22db7941124dadd534c161d62dc8d55edafe4a4be98c2a98bd699ce1782cdf0e
SHA512

5f80aa62c7e22d88a34b4965e165bbcde11b18db5ed57583e671281a266857d6e961bd0e7bedf06c387ed173bd6f588788109e1cee53d860bad8d87131c537b5
SSDEEP

384:i8axTh2IMTMCuRGRTkMb3+cl8PueXjPc0:Daxt2IMTxuRGRTr3rlCNc

Score

8^/10

Blocklisted process makes network request 1 IoCs

flow	pid	Process
13	2992	rundll32.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
660	Process not Found

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3704 wrote to memory of 2992	3704	rundll32.exe	79
PID 3704 wrote to memory of 2992	3704	rundll32.exe	79
PID 3704 wrote to memory of 2992	3704	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\22db7941124dadd534c161d62dc8d55edafe4a4be98c2a98bd699ce1782cdf0e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3704
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\22db7941124dadd534c161d62dc8d55edafe4a4be98c2a98bd699ce1782cdf0e.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:2992