374e1f63c9d50171c8379b89e8af7e11280f8009bbde898ee4c1d9781896a835

Analysis

max time kernel
88s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
06-11-2022 16:13

Target

374e1f63c9d50171c8379b89e8af7e11280f8009bbde898ee4c1d9781896a835.dll
Size

7KB
MD5

04f0889148cb74021d3118353dccd1b6
SHA1

40949c36493ed824afff890b73ac9866c141803e
SHA256

374e1f63c9d50171c8379b89e8af7e11280f8009bbde898ee4c1d9781896a835
SHA512

ebde76642e345d0082a1b7165f15262e584042bc282894babee5625b5a3659ffa92a4ef920a071994d8f9b41d70c2ec33e37fea9f7f165a3750d4e5499920110
SSDEEP

192:efMNikVy0DWDjzbFIJEC411JxOVEPNoTuJiYlj82JIVlDUKor/UJzJSd:efM

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 2116	2300	rundll32.exe	83
PID 2300 wrote to memory of 2116	2300	rundll32.exe	83
PID 2300 wrote to memory of 2116	2300	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\374e1f63c9d50171c8379b89e8af7e11280f8009bbde898ee4c1d9781896a835.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\374e1f63c9d50171c8379b89e8af7e11280f8009bbde898ee4c1d9781896a835.dll,#1
  2⤵
  PID:2116