fb38112f1062b8b0f3832d60b6ebf256945a1895f1826e3b6ea02fe49e65126a

Analysis

max time kernel
74s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 12:38

Target

fb38112f1062b8b0f3832d60b6ebf256945a1895f1826e3b6ea02fe49e65126a.dll
Size

296KB
MD5

94c3773128fed19e5271b945e577d176
SHA1

d9152e115f0d844dd0f81bb66f342706b8fc3c98
SHA256

fb38112f1062b8b0f3832d60b6ebf256945a1895f1826e3b6ea02fe49e65126a
SHA512

18cde4624e7f00c4be02223f9b4bf55f177578bab17ce937a6139c18d70a2b470a4a22cdc23e606a19fd0d92d4c9d269b0a629e3029295465cc099d6646a1edd
SSDEEP

3072:gLNikKwT1CQcOCbcLc1ep0zp7GEsWCd1fTe+X4oo4kfLeQTBfRoFixtkixB4K:gIjwRHPCH7RgRX4oo/fLeQTBJbDz

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2472 wrote to memory of 3168	2472	rundll32.exe	rundll32.exe
PID 2472 wrote to memory of 3168	2472	rundll32.exe	rundll32.exe
PID 2472 wrote to memory of 3168	2472	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fb38112f1062b8b0f3832d60b6ebf256945a1895f1826e3b6ea02fe49e65126a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fb38112f1062b8b0f3832d60b6ebf256945a1895f1826e3b6ea02fe49e65126a.dll,#1
  2⤵
  PID:3168