958361a02d0f1e4b729b3928b1568b42f1e3b04c6717c603a38bacbee0f04d26

Analysis

max time kernel
162s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 00:59

Target

958361a02d0f1e4b729b3928b1568b42f1e3b04c6717c603a38bacbee0f04d26.dll
Size

59KB
MD5

b3b0d1da7be2df771c42ca8681d70a05
SHA1

fc505fe10fa53d1b9bc35efb8aacecd37608b522
SHA256

958361a02d0f1e4b729b3928b1568b42f1e3b04c6717c603a38bacbee0f04d26
SHA512

1fe2cef04c19df43c6bfaeb7736f48084537bfbfdad988d745efa60d987696db4526c1cf09ae79f5ced010fdc4b338ab9c0b581891f2dfeec249b8e82dd7e908
SSDEEP

1536:MhBRVgrExucM30zPraCPMkdspSk2BERb/7btIGgRQV4:cRRst07WCkk22GRb9IJ44

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4248 wrote to memory of 4820	4248	rundll32.exe	79
PID 4248 wrote to memory of 4820	4248	rundll32.exe	79
PID 4248 wrote to memory of 4820	4248	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\958361a02d0f1e4b729b3928b1568b42f1e3b04c6717c603a38bacbee0f04d26.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4248
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\958361a02d0f1e4b729b3928b1568b42f1e3b04c6717c603a38bacbee0f04d26.dll,#1
  2⤵
  PID:4820