2099f2b5a8b1293ed9a4232633fa85218af7b5a922b356746d5d9fa79baa2702

Analysis

max time kernel
170s
max time network
192s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 05:56

Target

2099f2b5a8b1293ed9a4232633fa85218af7b5a922b356746d5d9fa79baa2702.dll
Size

5KB
MD5

d7370acf11b85eaba3b45f1d62ae9dd0
SHA1

4326f6faad3ae78b65268b52ab6b3164645d8a23
SHA256

2099f2b5a8b1293ed9a4232633fa85218af7b5a922b356746d5d9fa79baa2702
SHA512

748bd8f27aa3f704c060ae5c333bc7901094fc3dfd065eb7a6a571382b33847dabef1142c2e88b64262ee30bf4fade7c6ce3396bf9eae2ccd23535829d3cabae
SSDEEP

48:a5zjMTGcITBVQVE1lcEvJG3rY6S2R/cHvw1snsQdc85pKPPeRtF46BN+mX:iT3Qu8EBGJSQcHCmsQ+8OnGFPV

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4180 wrote to memory of 3668	4180	rundll32.exe	82
PID 4180 wrote to memory of 3668	4180	rundll32.exe	82
PID 4180 wrote to memory of 3668	4180	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2099f2b5a8b1293ed9a4232633fa85218af7b5a922b356746d5d9fa79baa2702.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4180
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2099f2b5a8b1293ed9a4232633fa85218af7b5a922b356746d5d9fa79baa2702.dll,#1
  2⤵
  PID:3668