388497e3e67e6c165c7fbdcd5a9c2a92a67dce93ee24609b0b2ea72c9d6752c4

Analysis

max time kernel
7s
max time network
2s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 15:59

Target

388497e3e67e6c165c7fbdcd5a9c2a92a67dce93ee24609b0b2ea72c9d6752c4.dll
Size

4KB
MD5

0d192f9e4d00d4c43271bf715fd075f6
SHA1

486ebaea9663b1251cc2687780d4fd122a6baa55
SHA256

388497e3e67e6c165c7fbdcd5a9c2a92a67dce93ee24609b0b2ea72c9d6752c4
SHA512

bbb83851e44b4d1e361a032d7895977841c197aa41b41a3a4fcf83bd52591c52a69fd7b2fb2f4eb2c5b2c090dbdfbfbbd4e210ab1d2a315101be5250835a2ee6
SSDEEP

48:a5zjMTGcITBVQVE1lcNpaUSKjp2MAIaTv/0nc1jfjXJ99:iT3Qu8vEKgignn1rx

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 1588	2228	rundll32.exe	75
PID 2228 wrote to memory of 1588	2228	rundll32.exe	75
PID 2228 wrote to memory of 1588	2228	rundll32.exe	75

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\388497e3e67e6c165c7fbdcd5a9c2a92a67dce93ee24609b0b2ea72c9d6752c4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\388497e3e67e6c165c7fbdcd5a9c2a92a67dce93ee24609b0b2ea72c9d6752c4.dll,#1
  2⤵
  PID:1588