22158b0efe72529c394670ef00de4cc65d6701b38da59711833a744f6c2a3bab

Analysis

max time kernel
145s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 10:23

Target

22158b0efe72529c394670ef00de4cc65d6701b38da59711833a744f6c2a3bab.dll
Size

137KB
MD5

1ea8e7f955c033c488ba8d4cdd18e6f0
SHA1

2d19b191135a51cafd1971510bfd54ba305dc021
SHA256

22158b0efe72529c394670ef00de4cc65d6701b38da59711833a744f6c2a3bab
SHA512

624d81304bf1b69c496a02536a98dbbde03db6e24887ca37f9cbdd2977bb47d5f13a4e32f1e5bf1e75fbcbbbe9603936cda793716aceab45bd079a3903bfd4ae
SSDEEP

3072:i8wA0TMD5Dqg0yN1nvAANSw8ltWoihGCyMOLySWst+fXxQ0IL/:i8w6D4Kotup0LWI+fg

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4808 wrote to memory of 2612	4808	rundll32.exe	80
PID 4808 wrote to memory of 2612	4808	rundll32.exe	80
PID 4808 wrote to memory of 2612	4808	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\22158b0efe72529c394670ef00de4cc65d6701b38da59711833a744f6c2a3bab.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4808
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\22158b0efe72529c394670ef00de4cc65d6701b38da59711833a744f6c2a3bab.dll,#1
  2⤵
  PID:2612