fc78c650cf39a1b8f47d0bad43d29d40542c9252c68a26d7ca5cecac6afb42be

Analysis

max time kernel
159s
max time network
170s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 08:37

Target

fc78c650cf39a1b8f47d0bad43d29d40542c9252c68a26d7ca5cecac6afb42be.dll
Size

40KB
MD5

35d8cb0198821047258dc9fa4a0631e8
SHA1

d3a3f9aa4ac831ac7cb99de9221dd9c4d5446765
SHA256

fc78c650cf39a1b8f47d0bad43d29d40542c9252c68a26d7ca5cecac6afb42be
SHA512

7c5142f5186e239aabeb16111a33b9876f54f63d18ccf5aac493491ceec7019d1b79cdfc3aa8591dfae0c9fd778936a75a78242f3f32ec5f3e70436fc27bc25d
SSDEEP

384:Ete2SIE+sNkjjx75pfSlFk+2CqZ9+AcHekE8B:iexHajt7zf+12TL+ALkdB

Score

1^/10

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2148	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1828 wrote to memory of 2148	1828	rundll32.exe	84
PID 1828 wrote to memory of 2148	1828	rundll32.exe	84
PID 1828 wrote to memory of 2148	1828	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fc78c650cf39a1b8f47d0bad43d29d40542c9252c68a26d7ca5cecac6afb42be.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1828
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fc78c650cf39a1b8f47d0bad43d29d40542c9252c68a26d7ca5cecac6afb42be.dll,#1
  2⤵
  - Suspicious use of FindShellTrayWindow
  PID:2148