46e684659a970ca6540f3746c705800da98df2f1b927a603710822d521603d66

Analysis

max time kernel
82s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2022 19:40

Target

46e684659a970ca6540f3746c705800da98df2f1b927a603710822d521603d66.dll
Size

45KB
MD5

483f35bcf4020a416354a18918b44f25
SHA1

7c81d2152a121e17af4afeaa761468343dc12437
SHA256

46e684659a970ca6540f3746c705800da98df2f1b927a603710822d521603d66
SHA512

899ab52b8f31f4a93b7bf673f369dc68e230305f6737dd83cc8d7724b16cdc58f25af263a73c449fc60bb94006b3dc9c59f07a4fed3a59c7c13cacd317c967da
SSDEEP

768:0NlcrRjTCCVUVHmgOMtitTjxyNq5ewMwkjw5I9tGc1ADjMl6t:0M9asUC4WTQNqNfkjw2Gul

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5028 wrote to memory of 4844	5028	rundll32.exe	71
PID 5028 wrote to memory of 4844	5028	rundll32.exe	71
PID 5028 wrote to memory of 4844	5028	rundll32.exe	71

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\46e684659a970ca6540f3746c705800da98df2f1b927a603710822d521603d66.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\46e684659a970ca6540f3746c705800da98df2f1b927a603710822d521603d66.dll,#1
  2⤵
  PID:4844

memory/4844-133-0x00000000001C0000-0x00000000001CF000-memory.dmp

Filesize
60KB

Download