3277cba8d82c01d4c882267cea91d7e6807eea4b212711d0bbc7625d4b38a931

Analysis

max time kernel
136s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 08:48

Target

3277cba8d82c01d4c882267cea91d7e6807eea4b212711d0bbc7625d4b38a931.dll
Size

99KB
MD5

4817b2a4f2d8f3faa21f66e7328c18e7
SHA1

48685c93331c902c6dd56826eb8e69587837584a
SHA256

3277cba8d82c01d4c882267cea91d7e6807eea4b212711d0bbc7625d4b38a931
SHA512

2028905946f325f23fd6a9a627a27b072216eab147cdabb03f32bcd81bb100545ebb86f8dc1de43136a23cced960c1b4d5d767f4e27db04db903b4be220a99e1
SSDEEP

1536:JVGqeHHrjdj9qcOeNtZVBhFyE4eW2nounBulRVyC3mO4r9l1OUsrXdEjNpu:JKLjdjAcztdhFXpWPzRNWZ/9szes

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4372 wrote to memory of 4148	4372	rundll32.exe	81
PID 4372 wrote to memory of 4148	4372	rundll32.exe	81
PID 4372 wrote to memory of 4148	4372	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3277cba8d82c01d4c882267cea91d7e6807eea4b212711d0bbc7625d4b38a931.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3277cba8d82c01d4c882267cea91d7e6807eea4b212711d0bbc7625d4b38a931.dll,#1
  2⤵
  PID:4148