e64d01056adc318ee2eca01509b1e9987ab1d69a4c501975159f63014da44975

Analysis

max time kernel
256s
max time network
299s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2022 20:38

Target

e64d01056adc318ee2eca01509b1e9987ab1d69a4c501975159f63014da44975.dll
Size

374KB
MD5

7a4175dee5b22cdddf901758df86ccc5
SHA1

c9d826fec7f8eb3b2b561e36d83b842163510a6c
SHA256

e64d01056adc318ee2eca01509b1e9987ab1d69a4c501975159f63014da44975
SHA512

b7f32a5b7293aa53eed618e9dae0047007bc8c960066009e5bf350341d37e23e00391e6a7632e3c8d0691598f584143527904b56cbeb571317084de08b629e2f
SSDEEP

6144:fiXXeyfDkBWC1z9r5k54Z5UALlpiDyVQi1hdwtW7zoxtAdjdjZAh4l:AOy7kz1z9r5kwJlID8XvoxtYhjZgO

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4980 wrote to memory of 3188	4980	rundll32.exe	80
PID 4980 wrote to memory of 3188	4980	rundll32.exe	80
PID 4980 wrote to memory of 3188	4980	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e64d01056adc318ee2eca01509b1e9987ab1d69a4c501975159f63014da44975.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4980
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e64d01056adc318ee2eca01509b1e9987ab1d69a4c501975159f63014da44975.dll,#1
  2⤵
  PID:3188