18c21e2887dd751c5ea94367c47c380d36c4e74b94af4c39b2a35ef8dbb20621

Analysis

max time kernel
90s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 05:52

Target

18c21e2887dd751c5ea94367c47c380d36c4e74b94af4c39b2a35ef8dbb20621.dll
Size

192KB
MD5

4fa296b7ff82884a8794e717f9d9df70
SHA1

e5166634cc7f31e36f1eb0bdc41a4ba792bfaf80
SHA256

18c21e2887dd751c5ea94367c47c380d36c4e74b94af4c39b2a35ef8dbb20621
SHA512

d322cea9a7b8196ed69ee3c70a16e42d3cb5f9a6c9983d705b0823a92deeee024a2e557fb3d28f95bb4b35218874f37b1b84cfc7411a54d4c838cb11ac2d470a
SSDEEP

3072:lqHMKO/UvZKPiFbW0T3WLyRIzYRgwIeFJP08sKJqPDGgCVfVZnoC0A4b4fUfK:+a/LiFbVTmaIzYRgJEh0CYPd2zno/U

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 516	1964	rundll32.exe	82
PID 1964 wrote to memory of 516	1964	rundll32.exe	82
PID 1964 wrote to memory of 516	1964	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\18c21e2887dd751c5ea94367c47c380d36c4e74b94af4c39b2a35ef8dbb20621.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\18c21e2887dd751c5ea94367c47c380d36c4e74b94af4c39b2a35ef8dbb20621.dll,#1
  2⤵
  PID:516