57b3a61873c6c6a9c6c5a2b86ad256f124e8f15c66fc798eab7c8d9c0340475e

Analysis

max time kernel
223s
max time network
263s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 05:01

Target
57b3a61873c6c6a9c6c5a2b86ad256f124e8f15c66fc798eab7c8d9c0340475e.dll
Size 4KB
Sample221201-fnkaasff26
SHA256 57b3a61873c6c6a9c6c5a2b86ad256f124e8f15c66fc798eab7c8d9c0340475e
MD5 61b154ac1b45f06779d5ec44d1f8b340
SHA1 b7be08f0e1d5924e88b2869ef8b378041f2c747d
SHA512 5c4b0e389f194945d6b081fe8b5c2d00b541873e7ab86f18d8833171e4a686893d0ba77804aa7bce51d04f04a7824750012a2dfc461f57c9d7168e1f9e48c873
SSDEEP 48:iMHGv8j2IcW89NYEArhWHR0MiiIsiI6lXVkqlcH2SuiS6o+mm9lJJ/:PmkiIz8UZrQ0MhI/ITqly9l3/
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 4376	1456	rundll32.exe	80
PID 1456 wrote to memory of 4376	1456	rundll32.exe	80
PID 1456 wrote to memory of 4376	1456	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\57b3a61873c6c6a9c6c5a2b86ad256f124e8f15c66fc798eab7c8d9c0340475e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\57b3a61873c6c6a9c6c5a2b86ad256f124e8f15c66fc798eab7c8d9c0340475e.dll,#1
  2⤵
  PID:4376