33336fb2226575d1d7ee1c92aa7d30c4dc7eed22261bd42741ced0a5349dcdfb

Analysis

max time kernel
182s
max time network
243s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 05:15

Target

33336fb2226575d1d7ee1c92aa7d30c4dc7eed22261bd42741ced0a5349dcdfb.dll
Size

141KB
MD5

41bac8bf71a7a22f01bf005d81e52826
SHA1

b4a9799588b709596add37b2ab4469aa718ab4e7
SHA256

33336fb2226575d1d7ee1c92aa7d30c4dc7eed22261bd42741ced0a5349dcdfb
SHA512

4d0582a381e3811ebb8fc036cc253b3018880dbbbf2e255707646a32f6733de7206226cd2c0e7c006277e571ea9c2eee91efc8f7c072970f82133aa870fbd71e
SSDEEP

3072:5ECAJhkdOP17s/qaOi08OwyHxcnZGCCXl11PllV1V:5EvgOP17s/F08OaoCC1vl1V

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4396 wrote to memory of 4392	4396	rundll32.exe	80
PID 4396 wrote to memory of 4392	4396	rundll32.exe	80
PID 4396 wrote to memory of 4392	4396	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\33336fb2226575d1d7ee1c92aa7d30c4dc7eed22261bd42741ced0a5349dcdfb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4396
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\33336fb2226575d1d7ee1c92aa7d30c4dc7eed22261bd42741ced0a5349dcdfb.dll,#1
  2⤵
  PID:4392