752cfdcdd2abaff01e4248970dab1cfaadd939eb58d873e1f059337048414000

Analysis

max time kernel
91s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
06-10-2022 10:58

Target

samples/eb7b33b436d034b2992c4f40082ba48c744d546daa3b49be8564f2c509bd80e9.dll
Size

226KB
MD5

2104fae9f482a72002204d74c1ca1e1f
SHA1

8941d889cb199a234d99c90ce78a96411b6dedb6
SHA256

eb7b33b436d034b2992c4f40082ba48c744d546daa3b49be8564f2c509bd80e9
SHA512

7bbea688d851a36951bfaad77c1832f66671fc79691bd4ac63ee50725c5f7fd3b5a441dee18b6e62586f4f2d0f0b7d3f2ee74120295bf083af899150dd3d8116
SSDEEP

6144:rWwweAGxK1y5Eoz4wrETDftDB3U0hWB9y/3G:rWlSzxrEvfFdU0YBK3G

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4940 wrote to memory of 1344	4940	rundll32.exe	50
PID 4940 wrote to memory of 1344	4940	rundll32.exe	50
PID 4940 wrote to memory of 1344	4940	rundll32.exe	50

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\samples\eb7b33b436d034b2992c4f40082ba48c744d546daa3b49be8564f2c509bd80e9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\samples\eb7b33b436d034b2992c4f40082ba48c744d546daa3b49be8564f2c509bd80e9.dll,#1
  2⤵
  PID:1344