c16f68dba2bac74c8701b26287141ca63f2df3fa8aa086aadb979d2a1288e049

Analysis

max time kernel
56s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 19:53

Target

c16f68dba2bac74c8701b26287141ca63f2df3fa8aa086aadb979d2a1288e049.dll
Size

89KB
MD5

ac243d5d30af1f40433c4edffb61ccdf
SHA1

6d8e745a4e3322c3f474970dad306d09aaf3a93e
SHA256

c16f68dba2bac74c8701b26287141ca63f2df3fa8aa086aadb979d2a1288e049
SHA512

ff223d9e3f6b8f94cdb5e4b36b96687021dcd753a66980b12924c0ace72301ef1a045d6b96f783be7ccf8e97a092be417e394553d9839a5077a78ca7856563b3
SSDEEP

1536:MxsjbHc9cul+RpCDkndiYlJc3GJxNWKi12reIeqtySxx:ZjbEczJnIYEGn0UKIeYySxx

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4872 wrote to memory of 4896	4872	rundll32.exe	81
PID 4872 wrote to memory of 4896	4872	rundll32.exe	81
PID 4872 wrote to memory of 4896	4872	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c16f68dba2bac74c8701b26287141ca63f2df3fa8aa086aadb979d2a1288e049.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4872
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c16f68dba2bac74c8701b26287141ca63f2df3fa8aa086aadb979d2a1288e049.dll,#1
  2⤵
  PID:4896