b79242972faf98c47ba7bf9b6059380a475b39e453852f0737c90704b9dedf22

Analysis

max time kernel
91s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2022, 21:20

Target

b79242972faf98c47ba7bf9b6059380a475b39e453852f0737c90704b9dedf22.dll
Size

5KB
MD5

00b648b9bcca782501233d80fbd40490
SHA1

af1104cfe088df83d236022f0dad4814032e3093
SHA256

b79242972faf98c47ba7bf9b6059380a475b39e453852f0737c90704b9dedf22
SHA512

72902a2f1afeb5de140153c018dc54fa0107320a8ac0aff1a2a8cbbaa1eb4283ec075251104b899d589d359927118f143d4179065f7b035b1d0cdb376f1c61e7
SSDEEP

96:XprYDpKnI6wJ+Ls7guyHejyn/I9l0iaijFmKTi:XUcA+ggd+W/If0ilFti

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4712 wrote to memory of 4960	4712	rundll32.exe	68
PID 4712 wrote to memory of 4960	4712	rundll32.exe	68
PID 4712 wrote to memory of 4960	4712	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b79242972faf98c47ba7bf9b6059380a475b39e453852f0737c90704b9dedf22.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b79242972faf98c47ba7bf9b6059380a475b39e453852f0737c90704b9dedf22.dll,#1
  2⤵
  PID:4960