79e3ff9e55d6b1ba98cc02882aff1a01182e0d762ca8af34f5df88a513e69a5f

Analysis

max time kernel
120s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
28/11/2022, 06:06

Target

79e3ff9e55d6b1ba98cc02882aff1a01182e0d762ca8af34f5df88a513e69a5f.dll
Size

21KB
MD5

b5680a94dabaa1e2d26dac97899437bb
SHA1

7e4df43fcd3f0bea3b28f5218c63a04dea1f1341
SHA256

79e3ff9e55d6b1ba98cc02882aff1a01182e0d762ca8af34f5df88a513e69a5f
SHA512

4a50df548fbcdb844df30a26ca4a93711b04b27f9f9cd65ef723a83478edbf8e030f04d484b8a7c51dce4f5860d078e2ab09428afccb2f09f4b2aeffc87632ae
SSDEEP

384:5+6vfxInNdfX6WoOfhwkMGQmU6qfV5MJvCxKTPBA7E3:w4WNdro+y8KVrMJvlTPm

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 2368	1516	rundll32.exe	81
PID 1516 wrote to memory of 2368	1516	rundll32.exe	81
PID 1516 wrote to memory of 2368	1516	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\79e3ff9e55d6b1ba98cc02882aff1a01182e0d762ca8af34f5df88a513e69a5f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\79e3ff9e55d6b1ba98cc02882aff1a01182e0d762ca8af34f5df88a513e69a5f.dll,#1
  2⤵
  PID:2368