122c18b13683dcc71797b8152673465b06b8b3deeb24248330d5ade8229d8551

Analysis

max time kernel
102s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2022, 07:39

Target

122c18b13683dcc71797b8152673465b06b8b3deeb24248330d5ade8229d8551.dll
Size

71KB
MD5

460a61b2d590070d3615fbf4cc3849d8
SHA1

19a6b57b68623c1183443c40bbfec653f7689091
SHA256

122c18b13683dcc71797b8152673465b06b8b3deeb24248330d5ade8229d8551
SHA512

37adc6c559625e75cb34b62bd01bc5d62ea028bd08c654bd1bce52c95929eecf5c8f2f76786f99148b46f93ba752fc31f339167b3c0422ac871f29c93e11aec9
SSDEEP

1536:9HF3cPoVBuSRqcNWjk9hV4o7Av9BDOcuC3UVj8:/3cPoVBPRjNWg7io7AlBCVC3UC

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3500 wrote to memory of 2188	3500	rundll32.exe	82
PID 3500 wrote to memory of 2188	3500	rundll32.exe	82
PID 3500 wrote to memory of 2188	3500	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\122c18b13683dcc71797b8152673465b06b8b3deeb24248330d5ade8229d8551.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3500
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\122c18b13683dcc71797b8152673465b06b8b3deeb24248330d5ade8229d8551.dll,#1
  2⤵
  PID:2188