74b3166cf8e7d54ebedaa96c53a29cfa779285062465b6823693d83dc6358166

Analysis

max time kernel
91s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 04:25

Target

74b3166cf8e7d54ebedaa96c53a29cfa779285062465b6823693d83dc6358166.dll
Size

73KB
MD5

451f1bd57746826e0411c4ae954fa0ec
SHA1

d14f1c7b728fb173b40ab8b025de3b532af854b7
SHA256

74b3166cf8e7d54ebedaa96c53a29cfa779285062465b6823693d83dc6358166
SHA512

57d304286aa5f3c8efb93fda189f036476334aac3f249a263f4005afa3869b538d75eef2b31410ba106e080d111b3558e679f4fe7895e0f751d69142c854e8df
SSDEEP

1536:csrG6j8I38Lmsc/awQ0mBsjhe+A8UgDRuuuaaozycVQy9w/oIE:c2vjPsLmxXQ0jteTWpztuNBE

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4876 wrote to memory of 4924	4876	rundll32.exe	49
PID 4876 wrote to memory of 4924	4876	rundll32.exe	49
PID 4876 wrote to memory of 4924	4876	rundll32.exe	49

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\74b3166cf8e7d54ebedaa96c53a29cfa779285062465b6823693d83dc6358166.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\74b3166cf8e7d54ebedaa96c53a29cfa779285062465b6823693d83dc6358166.dll,#1
  2⤵
  PID:4924