d441ac55a474c2154e62e25d7424554925eaf35f156e3c31e11612cc90c4c9b0

Analysis

max time kernel
132s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2022, 05:16

Target

d441ac55a474c2154e62e25d7424554925eaf35f156e3c31e11612cc90c4c9b0.dll
Size

32KB
MD5

08da52fef8c71cc865c6dca5f12d9c20
SHA1

263a771f257dc947a7dede27a82971c1872478b8
SHA256

d441ac55a474c2154e62e25d7424554925eaf35f156e3c31e11612cc90c4c9b0
SHA512

8d1fdb1b983feafc91c31851526bbef7a171e979f2b18ae9625570d94c4179b6ef3ed6dd783ac0cc386d206a2284687e1c038fa86fbc3094fd3643e04ba77499
SSDEEP

384:0YtYauty9x9aNoIS9Vic7JnnnfiWLwcde7QfOup77WH8+vOaMr+a0nJfBlvCR+9F:DtYlPuwcdfiwde73up7IBvOaA70J5ERa

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 4644	4656	rundll32.exe	78
PID 4656 wrote to memory of 4644	4656	rundll32.exe	78
PID 4656 wrote to memory of 4644	4656	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d441ac55a474c2154e62e25d7424554925eaf35f156e3c31e11612cc90c4c9b0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d441ac55a474c2154e62e25d7424554925eaf35f156e3c31e11612cc90c4c9b0.dll,#1
  2⤵
  PID:4644