b339b8e2e4f59518b07623ca0b4f7c61115df2b4e8305c056823276bc0fef362

Analysis

max time kernel
152s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 05:17

Target

b339b8e2e4f59518b07623ca0b4f7c61115df2b4e8305c056823276bc0fef362.dll
Size

24KB
MD5

7aba811395e805849022ddf46c555d41
SHA1

bf161b8cf64b857c66d3991e91732fa2c8c3997f
SHA256

b339b8e2e4f59518b07623ca0b4f7c61115df2b4e8305c056823276bc0fef362
SHA512

b00f02e81123fff51f40e52503acc69698fd7c065dc91d1ef89e6fed36ae782caf42bff484b2c35574bb083a078ee6a3a3747d3b3dc51a472f3abcaa702e6226
SSDEEP

192:fsNGS9RWanc9Lht82SrBOUzk9m4VM8GjFVemPej8V1TqMXky:fcG8W59LhtEQA/4O82FV9PS8Vkwky

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 1864	4884	rundll32.exe	83
PID 4884 wrote to memory of 1864	4884	rundll32.exe	83
PID 4884 wrote to memory of 1864	4884	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b339b8e2e4f59518b07623ca0b4f7c61115df2b4e8305c056823276bc0fef362.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b339b8e2e4f59518b07623ca0b4f7c61115df2b4e8305c056823276bc0fef362.dll,#1
  2⤵
  PID:1864