f4b3e746379907e8580ee0bd0e1da16b6b5f009fb8242009e3709c915b8595a4

Analysis

max time kernel
90s
max time network
116s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2022, 00:48

Target

f4b3e746379907e8580ee0bd0e1da16b6b5f009fb8242009e3709c915b8595a4.dll
Size

5KB
MD5

92dfaec68631ea19c0c7d1410db7f3a3
SHA1

6d03b845bc0d742f5211d73380f4e24bd5df793d
SHA256

f4b3e746379907e8580ee0bd0e1da16b6b5f009fb8242009e3709c915b8595a4
SHA512

fcea9a228c31e34949951607e86249628f24db858cf6b7d99851645144dd9af18dda71c27bdb2b206ceace3dd0b3ec6946c7d5d37b1bd62f3951dcba11b4a805
SSDEEP

96:PIV9yIjhsZrg0j6I/AhWNif5OyBEUUv0ASGUq5H/4:PyIIjWXGhquUvFUK

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3288 wrote to memory of 2464	3288	rundll32.exe	34
PID 3288 wrote to memory of 2464	3288	rundll32.exe	34
PID 3288 wrote to memory of 2464	3288	rundll32.exe	34

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f4b3e746379907e8580ee0bd0e1da16b6b5f009fb8242009e3709c915b8595a4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3288
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f4b3e746379907e8580ee0bd0e1da16b6b5f009fb8242009e3709c915b8595a4.dll,#1
  2⤵
  PID:2464