324ac439bbea9bd8ef0425164aec9a98fa936971bff2e887a5af759dfe3a5074

Analysis

max time kernel
107s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 16:59

Target
324ac439bbea9bd8ef0425164aec9a98fa936971bff2e887a5af759dfe3a5074.dll
Size 5KB
Sample221003-vhrvhsfgdp
SHA256 324ac439bbea9bd8ef0425164aec9a98fa936971bff2e887a5af759dfe3a5074
MD5 6bd0fe877b385a6de7ae154e72b9d5a5
SHA1 3cecb2c1bf6972d7aed9c9a83f0b51de276bfe37
SHA512 99a176ca98f6c89a72841448c34f0bf6a7db09d57d2d72fdec3881cdfee467715a2ebaf0a851c976e08a2eafdc28fe37b8b75e5ca9646e295ef129e70847ead2
SSDEEP 96:VGEETrMLH5UdoR2BK5JvSv0isdsJmeJHylyUf0k1SJ4ycJV:efM2xB0igQylyUpn
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4608 wrote to memory of 4908	4608	rundll32.exe	54
PID 4608 wrote to memory of 4908	4608	rundll32.exe	54
PID 4608 wrote to memory of 4908	4608	rundll32.exe	54

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\324ac439bbea9bd8ef0425164aec9a98fa936971bff2e887a5af759dfe3a5074.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4608
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\324ac439bbea9bd8ef0425164aec9a98fa936971bff2e887a5af759dfe3a5074.dll,#1
  2⤵
  PID:4908