46bcf877194436a89672ba79398ea493d38e74352d3e42d82429ef63950ce447

Analysis

max time kernel
276s
max time network
310s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 13:42

Target

46bcf877194436a89672ba79398ea493d38e74352d3e42d82429ef63950ce447.dll
Size

336KB
MD5

a4f01dd2e7aea1c16eee945a52735500
SHA1

e24d2faae32fc3207d150a69e1fa4643ea026a59
SHA256

46bcf877194436a89672ba79398ea493d38e74352d3e42d82429ef63950ce447
SHA512

57a315ca14b3cf6201ad011b9464cf0a2346702d63b4b71d2f8917d24480077cfacbd9ea8ac345f94641d331c18db54e11e49121010a021c28a31e99c597e82b
SSDEEP

6144:BYR65cL+/EfEq6QgCdiy74pvKTTJ8xnSYK82+AqC1W/IPwJ:Bll/EfEq6QgCdiUSCTTCxSYK82+xwyw

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 1092	1912	rundll32.exe	80
PID 1912 wrote to memory of 1092	1912	rundll32.exe	80
PID 1912 wrote to memory of 1092	1912	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\46bcf877194436a89672ba79398ea493d38e74352d3e42d82429ef63950ce447.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\46bcf877194436a89672ba79398ea493d38e74352d3e42d82429ef63950ce447.dll,#1
  2⤵
  PID:1092