042b9173c9fc37e27c7f9acdbde99af5447fc603742b799e5f5dbc6a6459a523

Analysis

max time kernel
92s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 16:51

Target

042b9173c9fc37e27c7f9acdbde99af5447fc603742b799e5f5dbc6a6459a523.dll
Size

5KB
MD5

34eb85e4be00254d4536729df626d345
SHA1

972dfbbe924fec1137629504b0b24b4f864c2b4f
SHA256

042b9173c9fc37e27c7f9acdbde99af5447fc603742b799e5f5dbc6a6459a523
SHA512

4ee2d8094c653db522490a0c31fb21347447a8c43027f3057928f1989ddcdc01701f2e822ee52ca203c312c3e3702121b50bf80c9462241df222742e6bb33830
SSDEEP

48:Ss0vOiamaF9wJqkECrhWR00scqn6dFH6pd0n7+uhRS9XTp1mW:z0I9wZLrY0/aH6pOn7XSJV1

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3480 wrote to memory of 1360	3480	rundll32.exe	82
PID 3480 wrote to memory of 1360	3480	rundll32.exe	82
PID 3480 wrote to memory of 1360	3480	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\042b9173c9fc37e27c7f9acdbde99af5447fc603742b799e5f5dbc6a6459a523.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\042b9173c9fc37e27c7f9acdbde99af5447fc603742b799e5f5dbc6a6459a523.dll,#1
  2⤵
  PID:1360