91287ca55c0f997f8cd06f3d15c9452d425f4d9e7f72bda29b41a45a0af5798e

Analysis

max time kernel
91s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 01:19

Target

91287ca55c0f997f8cd06f3d15c9452d425f4d9e7f72bda29b41a45a0af5798e.dll
Size

633KB
MD5

b565e0bb4bc59376a4419e350e7708d0
SHA1

5c174c7c2af53fda212d492c096bdd321c164a11
SHA256

91287ca55c0f997f8cd06f3d15c9452d425f4d9e7f72bda29b41a45a0af5798e
SHA512

77f12faebb3c157566118b2fa35f873277b661f812cdf0dc718db90c23ce49a8d66de6dcaab6e4193f86195df658846221b90269a25c0e28418ba64371e4e786
SSDEEP

12288:uOFDDBMt8grbueRic1YkyH8wvb8xcN2DZz8xEyyW0J6w:uOFDlMGgBMPVHDycNkzZvJl

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 4844	2808	rundll32.exe	82
PID 2808 wrote to memory of 4844	2808	rundll32.exe	82
PID 2808 wrote to memory of 4844	2808	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\91287ca55c0f997f8cd06f3d15c9452d425f4d9e7f72bda29b41a45a0af5798e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\91287ca55c0f997f8cd06f3d15c9452d425f4d9e7f72bda29b41a45a0af5798e.dll,#1
  2⤵
  PID:4844