937f60129c7e6669177385c2bccbc696863aabfcd126db9b062e5f31b3996907

Analysis

max time kernel
99s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
21/10/2022, 04:17

Target

937f60129c7e6669177385c2bccbc696863aabfcd126db9b062e5f31b3996907.dll
Size

101KB
MD5

78bd127b04c5d767e4e623776c7bf587
SHA1

50bb28aa8d185514e3312f89fc7ad6f450e29e21
SHA256

937f60129c7e6669177385c2bccbc696863aabfcd126db9b062e5f31b3996907
SHA512

cf3fb6011476bcff039820bbdb8f2b8d45e823c0aeb0f3427471a5171e25fa64c990dd5dc21b8f65ce60625b229cb7bdbf6ca1716edeb252c7e286c04dc93a22
SSDEEP

1536:JVGqeHHrjdj9qcM5TbnL2bDkEMGoKRQeZUE/LSwg4G601vN6/:JKLjdjAcM5j2bD7MGoRE/LnI601vN6/

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4852 wrote to memory of 4336	4852	rundll32.exe	82
PID 4852 wrote to memory of 4336	4852	rundll32.exe	82
PID 4852 wrote to memory of 4336	4852	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\937f60129c7e6669177385c2bccbc696863aabfcd126db9b062e5f31b3996907.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\937f60129c7e6669177385c2bccbc696863aabfcd126db9b062e5f31b3996907.dll,#1
  2⤵
  PID:4336