19221caca099a57388c4eaa6b257c884eec27f7027a844f2a8972c5065105822

Analysis

max time kernel
180s
max time network
192s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2022, 10:47

Target
19221caca099a57388c4eaa6b257c884eec27f7027a844f2a8972c5065105822.dll
Size 70KB
Sample221014-mvv4psbhcl
SHA256 19221caca099a57388c4eaa6b257c884eec27f7027a844f2a8972c5065105822
MD5 626aa5af77a0b3ebbf22913549333623
SHA1 d9eed0e1de586b9091c6e20b296a734198c55420
SHA512 a68347995e92d9b0f45d54e804e2e36406b2f4efeb93333e11dd30b24e605f9b4b23ca63022cbc0abb3fe66de0874d2a19539848f3c688825185e0f114d86a40
SSDEEP 1536:56uOLO5IdgkGxMX2XusucYZ9nT83xDxZfTqv6LlvP8gu/5x:56ujKgMX2XpVYrnT83txZfTqvklX8gun
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4980 wrote to memory of 5004	4980	rundll32.exe	82
PID 4980 wrote to memory of 5004	4980	rundll32.exe	82
PID 4980 wrote to memory of 5004	4980	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\19221caca099a57388c4eaa6b257c884eec27f7027a844f2a8972c5065105822.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4980
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\19221caca099a57388c4eaa6b257c884eec27f7027a844f2a8972c5065105822.dll,#1
  2⤵
  PID:5004