67fd5ff5c45893c309e77cfcf04949441e3ee8f7d240d71a339ebd97f54cb234

Analysis

max time kernel
151s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 17:13

Target

67fd5ff5c45893c309e77cfcf04949441e3ee8f7d240d71a339ebd97f54cb234.dll
Size

251KB
MD5

3a1160c416c92e4dff5c5ec9e3e82338
SHA1

42515dd0eb4d87384b36cbac2f83f30bb8d291fd
SHA256

67fd5ff5c45893c309e77cfcf04949441e3ee8f7d240d71a339ebd97f54cb234
SHA512

d698c32df7f98b9a1a361f315578233ec30da75a89a7069c19c8cb82f0b56ae6decf88f71fc463236592afd2713529c9016301a94588c52a66c4584ae18a76e8
SSDEEP

6144:1JEMA7LCSK41tvfoKM4RLYIvAAZ7Evwd6g83qR:1Cb5daIv83qR

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4476 wrote to memory of 5040	4476	rundll32.exe	rundll32.exe
PID 4476 wrote to memory of 5040	4476	rundll32.exe	rundll32.exe
PID 4476 wrote to memory of 5040	4476	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\67fd5ff5c45893c309e77cfcf04949441e3ee8f7d240d71a339ebd97f54cb234.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4476

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\67fd5ff5c45893c309e77cfcf04949441e3ee8f7d240d71a339ebd97f54cb234.dll,#1
2⤵
PID:5040