ca728355f3093878675ab797274e62b3438d99a5c48ae622e18dee9b48db47c4

Analysis

max time kernel
112s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
28-10-2022 21:54

Target

ca728355f3093878675ab797274e62b3438d99a5c48ae622e18dee9b48db47c4.dll
Size

28KB
MD5

0abe243841fc0e4b13f40651eb8c6d90
SHA1

db3513a53308346059cf1109ad11ee5813483130
SHA256

ca728355f3093878675ab797274e62b3438d99a5c48ae622e18dee9b48db47c4
SHA512

31b037c121dab9cc6b8c565ea67ed62c95d655069926460ed83d0bcf33111aa9792055c5be31d842ae6a00436bb38265852118a939f0c22670c03e0f367af500
SSDEEP

96:w41+l2n11FhplC7N7lM1yosB3OB9ErQAQY:MfrQAQ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4972 wrote to memory of 1340	4972	rundll32.exe	83
PID 4972 wrote to memory of 1340	4972	rundll32.exe	83
PID 4972 wrote to memory of 1340	4972	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ca728355f3093878675ab797274e62b3438d99a5c48ae622e18dee9b48db47c4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ca728355f3093878675ab797274e62b3438d99a5c48ae622e18dee9b48db47c4.dll,#1
  2⤵
  PID:1340