400bd3224f613b826bbff57b5f76d3cf9b8771af69e162d0ce20c5d7198709ee

Analysis

max time kernel
150s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2022, 17:19

Target

400bd3224f613b826bbff57b5f76d3cf9b8771af69e162d0ce20c5d7198709ee.dll
Size

124KB
MD5

66a8fad7f885dad96aeaaf4dc46f9480
SHA1

5758208c21f85338f6c0d60952aedea90615c394
SHA256

400bd3224f613b826bbff57b5f76d3cf9b8771af69e162d0ce20c5d7198709ee
SHA512

f78e859c862c322d1f7d5e44f0b6d080f3a74c4ce7ee3f38c958e8028cb6ec466c79bd610daac20e3b80e6cea1f6e41f31dc2bf05e71d1100130958494762477
SSDEEP

1536:ts+jlkPBfHtSkYoPPgC31dZj5RGIsINXIBIuIJkuvfZ/AuwWnFJy:1EBNRYoPPgylG7KuNyxvfGWFJy

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3268 wrote to memory of 4556	3268	rundll32.exe	83
PID 3268 wrote to memory of 4556	3268	rundll32.exe	83
PID 3268 wrote to memory of 4556	3268	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\400bd3224f613b826bbff57b5f76d3cf9b8771af69e162d0ce20c5d7198709ee.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3268
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\400bd3224f613b826bbff57b5f76d3cf9b8771af69e162d0ce20c5d7198709ee.dll,#1
  2⤵
  PID:4556