ef67cbf884b084103d61ec0bcfbe4e68f57e8c952da34051079d82870d3a60fe

Analysis

max time kernel
112s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2022 02:09

Target

ef67cbf884b084103d61ec0bcfbe4e68f57e8c952da34051079d82870d3a60fe.dll
Size

223KB
MD5

73eba15dc8ebe4f5e2ff5b38b03f5813
SHA1

9da5119da4d6f80215e5831a13579fdc639a836b
SHA256

ef67cbf884b084103d61ec0bcfbe4e68f57e8c952da34051079d82870d3a60fe
SHA512

0da7bd0a5405b2be9e993ea87ccaef7d8c81e621ccb4cd8a37aca4c1bee173ae277e7f9d46bce58a74e6e29055999ae6ae53138a0e7cb326f397a52a222a6fba
SSDEEP

3072:y/pW3srl+mxFh0Iea2MHep5Cdr8iY2hsK/6LsLF+3H:yBN+kFh0IH2M+p5Cyf2h9/ve

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4752 wrote to memory of 1724	4752	rundll32.exe	82
PID 4752 wrote to memory of 1724	4752	rundll32.exe	82
PID 4752 wrote to memory of 1724	4752	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ef67cbf884b084103d61ec0bcfbe4e68f57e8c952da34051079d82870d3a60fe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4752
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ef67cbf884b084103d61ec0bcfbe4e68f57e8c952da34051079d82870d3a60fe.dll,#1
  2⤵
  PID:1724