df2cba52fb45d28d7b99ebec29abdc9df5a763e3487d44f7f39d2958efbb49b0

Analysis

max time kernel
97s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2022 06:32

Target

df2cba52fb45d28d7b99ebec29abdc9df5a763e3487d44f7f39d2958efbb49b0.dll
Size

66KB
MD5

7caba58cea79facffb488211df3009fb
SHA1

64bf5b41d0baa68783946717fa4616324cc947a9
SHA256

df2cba52fb45d28d7b99ebec29abdc9df5a763e3487d44f7f39d2958efbb49b0
SHA512

802da0e69ab05640a7a759a5cb2155fae719f79c49773e066e104c3f56b058d17c59435dfcb1ad2724f8fb3e20a67e90decf2d08051ce312447fca6f94d4c724
SSDEEP

1536:9lB6IppA2d3/Yb4j+L+PbPD2nWZkiJiDdPVwe9:bRe2Bwb4aL+PTKnyPilVwG

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4860 wrote to memory of 4584	4860	rundll32.exe	83
PID 4860 wrote to memory of 4584	4860	rundll32.exe	83
PID 4860 wrote to memory of 4584	4860	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\df2cba52fb45d28d7b99ebec29abdc9df5a763e3487d44f7f39d2958efbb49b0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4860
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\df2cba52fb45d28d7b99ebec29abdc9df5a763e3487d44f7f39d2958efbb49b0.dll,#1
  2⤵
  PID:4584