49e040abd413a714a0e4d03f8ebe2bd8b5835c6894fda84ccf1459569a24cbb8

Analysis

max time kernel
169s
max time network
187s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28/11/2022, 01:05

Target

49e040abd413a714a0e4d03f8ebe2bd8b5835c6894fda84ccf1459569a24cbb8.dll
Size

67KB
MD5

253a177fae0f054e50617af1ce248216
SHA1

e6052c65072e8b15cc43183e884951478ab2a021
SHA256

49e040abd413a714a0e4d03f8ebe2bd8b5835c6894fda84ccf1459569a24cbb8
SHA512

07e2b235a4081e026d1e83d17ca4ec981e9ed41fd3d0d6bc1a37680d4548e8a8c6d10a069f1ca3d97b1aac8ba734ae8b370d8c7a6c5e09996db8fd443066c30e
SSDEEP

1536:8nrxDussGn4AAejPC7Mp/c+HJgKKtLhVuDvRPs:y6tV0pk+pgRLPuD5s

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 5104	1224	rundll32.exe	80
PID 1224 wrote to memory of 5104	1224	rundll32.exe	80
PID 1224 wrote to memory of 5104	1224	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\49e040abd413a714a0e4d03f8ebe2bd8b5835c6894fda84ccf1459569a24cbb8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\49e040abd413a714a0e4d03f8ebe2bd8b5835c6894fda84ccf1459569a24cbb8.dll,#1
  2⤵
  PID:5104