44d0587e98c837ffe42ad841bea11c0799cd257f9d3f47d9eea08e1d29664de6

Analysis

max time kernel
100s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 04:46

Target

44d0587e98c837ffe42ad841bea11c0799cd257f9d3f47d9eea08e1d29664de6.dll
Size

32KB
MD5

59e71a11038d9f927222a8196ea1db24
SHA1

4fd9e8b065a4a1bfac69350435f8db89cd6f25f3
SHA256

44d0587e98c837ffe42ad841bea11c0799cd257f9d3f47d9eea08e1d29664de6
SHA512

83de19427633576b852403646b564bf517ac07a64251c8a8fda93e843cbd6df9db703931cfec923a1d8f2cd7cb7459fd3e7322046c376a43dc278ee02f0de780
SSDEEP

384:T3Djv9NYwKEZwAETtPR9eLi4bpA5E77qDE7h70prlawgJFJfegYCRLnJ:T3fGMXaILzb+E7qEF70NlhCDWglR7J

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4104 wrote to memory of 5004	4104	rundll32.exe	81
PID 4104 wrote to memory of 5004	4104	rundll32.exe	81
PID 4104 wrote to memory of 5004	4104	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\44d0587e98c837ffe42ad841bea11c0799cd257f9d3f47d9eea08e1d29664de6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4104
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\44d0587e98c837ffe42ad841bea11c0799cd257f9d3f47d9eea08e1d29664de6.dll,#1
  2⤵
  PID:5004