3ab417d01dda1106d12eab99de61f5989ecd881250ec1a599e642555cf380046

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28-11-2022 03:12

Target

3ab417d01dda1106d12eab99de61f5989ecd881250ec1a599e642555cf380046.dll
Size

152KB
MD5

6e1fd1e95cd7095dea79b7b1a395d797
SHA1

36767cc01064764e851b03d55153b4809c8bdb91
SHA256

3ab417d01dda1106d12eab99de61f5989ecd881250ec1a599e642555cf380046
SHA512

066a903d8728a895c2d3242c6bfa2a61ec2ffa1ad9eb9be29d016be723e7e4b590f982b746abc291ac7168af5c132e7abac5fe00aff2fe0cfc7256d7bcd45bfc
SSDEEP

3072:zYWyVvknQMb3rhTSCWNJ26LMLmA6UWfU/sG5DeYKFXD4/5A5qNfHFV:ZGMlmNoF75jB5oyfn

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5044 wrote to memory of 4636	5044	rundll32.exe	80
PID 5044 wrote to memory of 4636	5044	rundll32.exe	80
PID 5044 wrote to memory of 4636	5044	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ab417d01dda1106d12eab99de61f5989ecd881250ec1a599e642555cf380046.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ab417d01dda1106d12eab99de61f5989ecd881250ec1a599e642555cf380046.dll,#1
  2⤵
  PID:4636