48615f1d9232984b92660e0c66862a030fc49db6961bd4f080781803c5bffe99

Analysis

max time kernel
160s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 05:01

Target

48615f1d9232984b92660e0c66862a030fc49db6961bd4f080781803c5bffe99.dll
Size

7KB
MD5

a6d714cfc58f1834ce93a1fd5d268370
SHA1

ec5f17f8bfa5eae9f5028d9e9cda6395c8938bc2
SHA256

48615f1d9232984b92660e0c66862a030fc49db6961bd4f080781803c5bffe99
SHA512

e692366d985f06601a5c49120a00216b144fe1abe5c8f1c4772b4ae8aa45e934dcd6f82f30b34b9b2891423cbf5904fa7b71f473f9c91a9ce4a220c6922e3451
SSDEEP

192:unSR6bgYcGmcuQImEkAiTZ4zWIhArH6jRv:uZcGmcuxVkAiTZ4zWIhArH6jRv

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 4392	1700	rundll32.exe	82
PID 1700 wrote to memory of 4392	1700	rundll32.exe	82
PID 1700 wrote to memory of 4392	1700	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\48615f1d9232984b92660e0c66862a030fc49db6961bd4f080781803c5bffe99.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\48615f1d9232984b92660e0c66862a030fc49db6961bd4f080781803c5bffe99.dll,#1
  2⤵
  PID:4392