41992610b379ec70107bda9bea5269b5f87c0aabbe5db5d98f387b5364166a5e

Analysis

max time kernel
198s
max time network
206s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 04:54

Target

41992610b379ec70107bda9bea5269b5f87c0aabbe5db5d98f387b5364166a5e.dll
Size

54KB
MD5

671e2be09abadf3cf0e4c51111988cca
SHA1

30e69d15fdc248fca17f47cae699784e333fb96f
SHA256

41992610b379ec70107bda9bea5269b5f87c0aabbe5db5d98f387b5364166a5e
SHA512

c2ff0acd6b6aed54d652f850899e0df94c6c6737b0b2f7f53be39e45e175797c64870f7c9cab34ae268e462c4f7473e57d0b6f0ab3e8afa4e35da072dc22480b
SSDEEP

1536:BfQAl+7ovOlpRq7wJ9r26enO2QnMbKFmsWT:dQAl+pbM7OudQn6KFmsWT

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 4836	4928	rundll32.exe	79
PID 4928 wrote to memory of 4836	4928	rundll32.exe	79
PID 4928 wrote to memory of 4836	4928	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\41992610b379ec70107bda9bea5269b5f87c0aabbe5db5d98f387b5364166a5e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\41992610b379ec70107bda9bea5269b5f87c0aabbe5db5d98f387b5364166a5e.dll,#1
  2⤵
  PID:4836