4dab8e4f6ce52a35f8b31b8013837ce94af8f7858ebc8e6d9ccaf14542840b74

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 14:02

Target

4dab8e4f6ce52a35f8b31b8013837ce94af8f7858ebc8e6d9ccaf14542840b74.dll
Size

72KB
MD5

664e81cf9d825ba9ca3d08e5d942189b
SHA1

b0c12333fa9c04ac880e5d886dc640b7eeb07f21
SHA256

4dab8e4f6ce52a35f8b31b8013837ce94af8f7858ebc8e6d9ccaf14542840b74
SHA512

3e1fcada3af6571a472866e6d16722cedc1dd735ed6c4e9e78c5b159b2529e384e119063867ff682ff512d46751b75bb1a097199e36e33df459006c411f5fc13
SSDEEP

1536:6q/7dyokWxLWJoMRWrjMkpVk3QFcjfuQURd7By1Km8fiWM:627CWhWJoMyjMkppcjlo1m8f6

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 2816	2672	rundll32.exe	78
PID 2672 wrote to memory of 2816	2672	rundll32.exe	78
PID 2672 wrote to memory of 2816	2672	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4dab8e4f6ce52a35f8b31b8013837ce94af8f7858ebc8e6d9ccaf14542840b74.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4dab8e4f6ce52a35f8b31b8013837ce94af8f7858ebc8e6d9ccaf14542840b74.dll,#1
  2⤵
  PID:2816