7741f019d96f3233464d1db08c811efd35eca6ed08d7ee4d6876b4acce5bf29f

Analysis

max time kernel
135s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 02:58

Target

7741f019d96f3233464d1db08c811efd35eca6ed08d7ee4d6876b4acce5bf29f.dll
Size

14KB
MD5

edc62d380159520be913625cfbb8ea51
SHA1

9a933b8df6fef96085975b2e3638a1fb27735a06
SHA256

7741f019d96f3233464d1db08c811efd35eca6ed08d7ee4d6876b4acce5bf29f
SHA512

a0800b0e1d9840ef8e1fb73c64766771f74dab8d93b70853b0e5a6134df9d5b722e14d455563c1fdb97fc7cba08dd83204a4b210d702d240181a854a7f52be62
SSDEEP

48:yi2CaKeIymDY1/0Grvq0JuP+HmffuBeuR5csKuUH:mCnFkLvFJfmffuPR5FU

Score

1^/10

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
648	Process not Found

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 1964	2564	rundll32.exe	78
PID 2564 wrote to memory of 1964	2564	rundll32.exe	78
PID 2564 wrote to memory of 1964	2564	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7741f019d96f3233464d1db08c811efd35eca6ed08d7ee4d6876b4acce5bf29f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7741f019d96f3233464d1db08c811efd35eca6ed08d7ee4d6876b4acce5bf29f.dll,#1
  2⤵
  PID:1964