299521b46ff663ceb6569a6f685798c4c1100e5ec053e22d7c8c749d5388ba97

Analysis

max time kernel
159s
max time network
184s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 12:21

Target

299521b46ff663ceb6569a6f685798c4c1100e5ec053e22d7c8c749d5388ba97.dll
Size

817KB
MD5

21425a8895b0343e56f82ae791f73ab0
SHA1

cb0077facbbc001ae1d4130ef6bc3d7c7c4920c9
SHA256

299521b46ff663ceb6569a6f685798c4c1100e5ec053e22d7c8c749d5388ba97
SHA512

b87e8e2f8dc05b5b37b1b26393afce10f056b96d2e75ba7bade02f0d3d97fedd451a8853021ffba2209d6c9b1d7b70cc41726f91fdd42c5baa30f764d6224792
SSDEEP

12288:zCR0sfbz8QwSOh+PBFayDTAZju0sBdZ7ATm8zI3jqaBjes/fD:z9GX8JSOM5FayDTAZa0GdZ7G9Emaks/r

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 4972	2928	rundll32.exe	82
PID 2928 wrote to memory of 4972	2928	rundll32.exe	82
PID 2928 wrote to memory of 4972	2928	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\299521b46ff663ceb6569a6f685798c4c1100e5ec053e22d7c8c749d5388ba97.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\299521b46ff663ceb6569a6f685798c4c1100e5ec053e22d7c8c749d5388ba97.dll,#1
  2⤵
  PID:4972