3600fd1047a498c73d106e2207f85161dd2b4eb09e5738ea2ca1d663ea8649f9

Analysis

max time kernel
201s
max time network
205s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 17:08

Target

3600fd1047a498c73d106e2207f85161dd2b4eb09e5738ea2ca1d663ea8649f9.dll
Size

18KB
MD5

945ca5f84e2b9f631758e8f8a76f5d20
SHA1

ace6087961d664c9e08a2d89b66273d39b9c3903
SHA256

3600fd1047a498c73d106e2207f85161dd2b4eb09e5738ea2ca1d663ea8649f9
SHA512

49ec13ac7b907b010802c138ec939eb08e1e9db37f8027dea52615305a8e17269e6c5237898c7ebdbd43b44140dbe55aa3255f7454cd0292cf41cdbf9022a6cd
SSDEEP

384:96CiGC+GoC37M6F0yWqYkD68PXR+zCru60vivma:91iO27MUWXkvXR++ruXv+p

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4092 wrote to memory of 4952	4092	rundll32.exe	78
PID 4092 wrote to memory of 4952	4092	rundll32.exe	78
PID 4092 wrote to memory of 4952	4092	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3600fd1047a498c73d106e2207f85161dd2b4eb09e5738ea2ca1d663ea8649f9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4092
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3600fd1047a498c73d106e2207f85161dd2b4eb09e5738ea2ca1d663ea8649f9.dll,#1
  2⤵
  PID:4952