3459d4c84c94cd067a80cba5ef39ec59bbad52a43eaa4b3bd2ea055d7c7b2bd3

Analysis

max time kernel
112s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 05:05

Target

3459d4c84c94cd067a80cba5ef39ec59bbad52a43eaa4b3bd2ea055d7c7b2bd3.dll
Size

6KB
MD5

026ab5a96ea533a2e2ef0b34222eb390
SHA1

18bfd975f991939bcfa578b28dcc97fa71c7c9b9
SHA256

3459d4c84c94cd067a80cba5ef39ec59bbad52a43eaa4b3bd2ea055d7c7b2bd3
SHA512

ad6b0956dc477a6017b29d0c7e106deefae6c2855864f24227085ba99b9a99ec3455889c4a5a747a3d7b2832f637376a7eda8552bbf963b1a75f07ddb3ec793b
SSDEEP

96:Ts1Wnnnynnnnnnnn6nnann7nnXnnbnnKniROXJXIjy:YXA

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4780 wrote to memory of 1352	4780	rundll32.exe	79
PID 4780 wrote to memory of 1352	4780	rundll32.exe	79
PID 4780 wrote to memory of 1352	4780	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3459d4c84c94cd067a80cba5ef39ec59bbad52a43eaa4b3bd2ea055d7c7b2bd3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4780
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3459d4c84c94cd067a80cba5ef39ec59bbad52a43eaa4b3bd2ea055d7c7b2bd3.dll,#1
  2⤵
  PID:1352