519bb9a2fef0ef4ec71449960dc44c80bf91745263d61ab72c2bf8ae0c732048

Analysis

max time kernel
509s
max time network
511s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26-10-2022 23:52

Target

0d6014f1d2487230c3bb38f31d2742577f84fd2f2e0d97be5fb9cf28b7ab6de9_unpacked.dll
Size

50KB
MD5

48c862de90f908af7040248fcfb59b1e
SHA1

cece2de01c06efcf1c3e8524cad3dbcbab7e102d
SHA256

519bb9a2fef0ef4ec71449960dc44c80bf91745263d61ab72c2bf8ae0c732048
SHA512

7622816c0048d2e152d06c2094cfc306ed03369d7967875d723c47de68e6b0f0c0957d3197c3575ea5dcbe283a68f80c5cfd7dd8eaa951a6041835974a82a7cb
SSDEEP

1536:jiOtW7hqlalXHQc1cWIyHGyzVR7fsMH57k/q:OOtW7hqlalXnuyHl7fV57k

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3976 wrote to memory of 2092	3976	rundll32.exe	rundll32.exe
PID 3976 wrote to memory of 2092	3976	rundll32.exe	rundll32.exe
PID 3976 wrote to memory of 2092	3976	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0d6014f1d2487230c3bb38f31d2742577f84fd2f2e0d97be5fb9cf28b7ab6de9_unpacked.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3976

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0d6014f1d2487230c3bb38f31d2742577f84fd2f2e0d97be5fb9cf28b7ab6de9_unpacked.dll,#1
2⤵
PID:2092