b4e21feabb01e8780071413072b13c8f70bd209f7175bb6252c918a07141b26d

Analysis

max time kernel
133s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 19:19

Target

b4e21feabb01e8780071413072b13c8f70bd209f7175bb6252c918a07141b26d.dll
Size

538KB
MD5

6236343c35d0c4c571934cfc80bde8cc
SHA1

46a1d7d15ea535d1bb58acb020c253a465f303b7
SHA256

b4e21feabb01e8780071413072b13c8f70bd209f7175bb6252c918a07141b26d
SHA512

1f36bbd05c92881f01e4476b35dc2b53601d2c85475819448424931b87d5b6b483f192df8954a4fdc4a830d4d7e82b45dde880f7d1fdd7a3b9ec12158a7fa696
SSDEEP

6144:I4bvBxVzGaywrXtgpIjYAiGBnCP9OUAt/b77:zB5ywrXALLGAPE3/H7

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4852 wrote to memory of 4824	4852	rundll32.exe	82
PID 4852 wrote to memory of 4824	4852	rundll32.exe	82
PID 4852 wrote to memory of 4824	4852	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b4e21feabb01e8780071413072b13c8f70bd209f7175bb6252c918a07141b26d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b4e21feabb01e8780071413072b13c8f70bd209f7175bb6252c918a07141b26d.dll,#1
  2⤵
  PID:4824

memory/4824-133-0x0000000010000000-0x00000000100DF000-memory.dmp

Filesize
892KB

Download
memory/4824-134-0x0000000010000000-0x00000000100DF000-memory.dmp

Filesize
892KB

Download