39d5a67611957769bfd1f0f1dcfedb1d8aaaa40f2e655612fcf84cf018e824ab

Analysis

max time kernel
135s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28/11/2022, 04:35

Target

39d5a67611957769bfd1f0f1dcfedb1d8aaaa40f2e655612fcf84cf018e824ab.dll
Size

34KB
MD5

66adf0091a26b2bcb3404f60437d2ae1
SHA1

c6cf88593d0769d9eb7675567bb1325823c78bff
SHA256

39d5a67611957769bfd1f0f1dcfedb1d8aaaa40f2e655612fcf84cf018e824ab
SHA512

e83dfb15445930d8bc7f6865e7942e26817a8b4dfd5768d7ea3404dff307aae19f8d8688633c3542a93b52999ac1bfb90e8a06ae758bbdeda6ffbac93b6b49a2
SSDEEP

768:kQ3Q80nm82+0pXYnAtZTtX4MBDJGxIduBBQARQki9hZhHADG:J3186jGxIduBBQAR+1cG

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4028 wrote to memory of 1284	4028	rundll32.exe	79
PID 4028 wrote to memory of 1284	4028	rundll32.exe	79
PID 4028 wrote to memory of 1284	4028	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\39d5a67611957769bfd1f0f1dcfedb1d8aaaa40f2e655612fcf84cf018e824ab.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\39d5a67611957769bfd1f0f1dcfedb1d8aaaa40f2e655612fcf84cf018e824ab.dll,#1
  2⤵
  PID:1284