b81a307bb2f68c1c37b9c8e36ab26d261f5f69478f60758d0b17443c53cb850f

Analysis

max time kernel
140s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02-10-2022 09:29

Target

b81a307bb2f68c1c37b9c8e36ab26d261f5f69478f60758d0b17443c53cb850f.dll
Size

77KB
MD5

70ee452c88cdbdca92249f6c22c9832a
SHA1

bc1030185cbc35b180463eb065a295bd9b62d6f1
SHA256

b81a307bb2f68c1c37b9c8e36ab26d261f5f69478f60758d0b17443c53cb850f
SHA512

ff2c5cd71e4ccc290c360d5a6379760c949827bea8061a756d97d85d406dd81bfd51fde3dc5747d8ecd9e9c7610b9b5f90b5256e6bf34bd4dd95b0b700d5896e
SSDEEP

1536:5/72Y9JesUPKHuvBLRAO0Pd96PMm6eJVeKOdUF:5DP9JesUh5LRAD6PMTejWa

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1168 wrote to memory of 4640	1168	rundll32.exe	82
PID 1168 wrote to memory of 4640	1168	rundll32.exe	82
PID 1168 wrote to memory of 4640	1168	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b81a307bb2f68c1c37b9c8e36ab26d261f5f69478f60758d0b17443c53cb850f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1168
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b81a307bb2f68c1c37b9c8e36ab26d261f5f69478f60758d0b17443c53cb850f.dll,#1
  2⤵
  PID:4640