d2bc63c2f935f3936f57b0cff6aea2b81bc1a582fb770611d0065f52eea63714

Analysis

max time kernel
185s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02-10-2022 15:48

Target

d2bc63c2f935f3936f57b0cff6aea2b81bc1a582fb770611d0065f52eea63714.dll
Size

7KB
MD5

65fc127363f06e027e99f84b9e1a2801
SHA1

6a9e0d74f5136e3196e95f7e2b4d8936f2933af9
SHA256

d2bc63c2f935f3936f57b0cff6aea2b81bc1a582fb770611d0065f52eea63714
SHA512

a4dfbfe63c5e834eb3ac49126d634a4e87a7e2b52ad253dd638db82fe6022d84fb8f0a669fb5f904e16951d83da754ea6d222dde974fc6c52b1b6e1380caa384
SSDEEP

96:FlWrYDpKnI6wJ+Ls7guyHejyn/I9l0ik81VBSyCZo:Fl1cA+ggd+W/If0ikknD+o

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 4708	2820	rundll32.exe	81
PID 2820 wrote to memory of 4708	2820	rundll32.exe	81
PID 2820 wrote to memory of 4708	2820	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d2bc63c2f935f3936f57b0cff6aea2b81bc1a582fb770611d0065f52eea63714.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d2bc63c2f935f3936f57b0cff6aea2b81bc1a582fb770611d0065f52eea63714.dll,#1
  2⤵
  PID:4708