546b8a6fd7689ac66dadf988df4e24eac02ee645090e7d6dac5c0d15f3bbfc6f

Analysis

max time kernel
138s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 09:45

Target

546b8a6fd7689ac66dadf988df4e24eac02ee645090e7d6dac5c0d15f3bbfc6f.dll
Size

67KB
MD5

3fa03580e820861029ecf450eae7d04b
SHA1

4bee275e2173c09d9e24fce54d1b188f2f39333f
SHA256

546b8a6fd7689ac66dadf988df4e24eac02ee645090e7d6dac5c0d15f3bbfc6f
SHA512

1794672999618f3f9fb6e3d97e6fec8a4fc65381a5b2e8761bca7c90649fba22dc575c1d23141618b9fbaef6ffe2cc04a467337606450727a1cbf24f871b96c2
SSDEEP

1536:8nrxDussGn4AAejPC7Mp/c+HJgKKtLhVuDvRPN:y6tV0pk+pgRLPuD5N

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4820 wrote to memory of 4332	4820	rundll32.exe	84
PID 4820 wrote to memory of 4332	4820	rundll32.exe	84
PID 4820 wrote to memory of 4332	4820	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\546b8a6fd7689ac66dadf988df4e24eac02ee645090e7d6dac5c0d15f3bbfc6f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\546b8a6fd7689ac66dadf988df4e24eac02ee645090e7d6dac5c0d15f3bbfc6f.dll,#1
  2⤵
  PID:4332