4c604680e8c35865c73d1738a4db843646cc03687a3c02a9470f76e15c10710a

Analysis

max time kernel
137s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2022, 13:35

Target

4c604680e8c35865c73d1738a4db843646cc03687a3c02a9470f76e15c10710a.dll
Size

32KB
MD5

6c4d239c7e3c9da511c51506c03bce06
SHA1

ba4322b582d796292d27bea308341ff457646c23
SHA256

4c604680e8c35865c73d1738a4db843646cc03687a3c02a9470f76e15c10710a
SHA512

68652231fcd061b17b424615c37c9e9613b57d668ed5e233cb790daedb71b5a0afe90f9b3402812d11fe02c9fdc20458922b7d56bec1f4fb99deafe1f0d74671
SSDEEP

768:bN/CMPCo5t+dOpk7Vz7LPT1IShVD8R96HZVz:bN/CMPCA4Oe57LrXHAR+Z9

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4552 wrote to memory of 4120	4552	rundll32.exe	82
PID 4552 wrote to memory of 4120	4552	rundll32.exe	82
PID 4552 wrote to memory of 4120	4552	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4c604680e8c35865c73d1738a4db843646cc03687a3c02a9470f76e15c10710a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4552
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4c604680e8c35865c73d1738a4db843646cc03687a3c02a9470f76e15c10710a.dll,#1
  2⤵
  PID:4120