99a21f2da999d6f40c00dcfb0740e1551e1e24295cd3caf1eb9f1a7bba692a13

Analysis

max time kernel
157s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23/11/2022, 20:05

Target

99a21f2da999d6f40c00dcfb0740e1551e1e24295cd3caf1eb9f1a7bba692a13.dll
Size

110KB
MD5

15a786c2c1180d79fc365bea114bb79d
SHA1

40aa814829b979f2488cffc81e8c0392df1d4ea6
SHA256

99a21f2da999d6f40c00dcfb0740e1551e1e24295cd3caf1eb9f1a7bba692a13
SHA512

3dc0223f1cc32c40dce0a460549834f591b526563d07e51def57e2b18341634422e2e69076d871b92a51a4e5c3d39de1ad8d127091682d805f0b194afcfbd2fe
SSDEEP

3072:pymhYhCqgNzpk+Pl6aZ+FRPSafeRH2oLS/ErULJ3:p/hYhERPZZAFFfe2Ke3

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 2276	2684	rundll32.exe	81
PID 2684 wrote to memory of 2276	2684	rundll32.exe	81
PID 2684 wrote to memory of 2276	2684	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\99a21f2da999d6f40c00dcfb0740e1551e1e24295cd3caf1eb9f1a7bba692a13.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\99a21f2da999d6f40c00dcfb0740e1551e1e24295cd3caf1eb9f1a7bba692a13.dll,#1
  2⤵
  PID:2276