b1b891085aeb240f93b362aec2707b66c875cbb61450c7b6d8ce37bf18a975bc

Analysis

max time kernel
120s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 21:27

Target

b1b891085aeb240f93b362aec2707b66c875cbb61450c7b6d8ce37bf18a975bc.dll
Size

92KB
MD5

67fe64e48223c0d3bdc3fecbe1cfe767
SHA1

6ab25822ea55e05525ebea638a0d38bbc05f2c9f
SHA256

b1b891085aeb240f93b362aec2707b66c875cbb61450c7b6d8ce37bf18a975bc
SHA512

49b130b5ddf19dc8318cb37e166222c8af9b1389149f38de1db57186c5ac3dc5309daab2a61d6f2df5a3ca4e5a338ab85510a2a2850401f331928b52394d22c2
SSDEEP

1536:qev/+xb6k8nw8MRnDkmSk+/zra2kCv8M62QNsx+0MkW2J5wrHFw/:qeeR6k8nw8EDRybra2kCv8BvZ/12JKF

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4316 wrote to memory of 3988	4316	rundll32.exe	82
PID 4316 wrote to memory of 3988	4316	rundll32.exe	82
PID 4316 wrote to memory of 3988	4316	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b1b891085aeb240f93b362aec2707b66c875cbb61450c7b6d8ce37bf18a975bc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4316
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b1b891085aeb240f93b362aec2707b66c875cbb61450c7b6d8ce37bf18a975bc.dll,#1
  2⤵
  PID:3988