01c99e280fa9592855885748b317fd66b994e469e92c64ed2b90ee15c930291b

Analysis

max time kernel
205s
max time network
235s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 06:59

Target

01c99e280fa9592855885748b317fd66b994e469e92c64ed2b90ee15c930291b.dll
Size

136KB
MD5

e75081fb0a2a61497a79bf6205908cf0
SHA1

ed3350f73469de77550099d16f21e27e09a3ad98
SHA256

01c99e280fa9592855885748b317fd66b994e469e92c64ed2b90ee15c930291b
SHA512

5d7d3dfc14c2698d38a72e1eeec0185d90e84e4c9637e8cdd7ae5609632ee2fc3a95d859fc26f70a8eb6ced93125f538f2f1d90bba836c0e6ee91cac2312c5c8
SSDEEP

1536:eQil3UPcEQt1QJEJCuoMLMZlYybR9qVG1SL8wD4oKW5V0k93LlYIpNieV:zil3UPjQtYBMg+KqVZK+V0kFLlNNi

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 548 wrote to memory of 2844	548	rundll32.exe	79
PID 548 wrote to memory of 2844	548	rundll32.exe	79
PID 548 wrote to memory of 2844	548	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\01c99e280fa9592855885748b317fd66b994e469e92c64ed2b90ee15c930291b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:548
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\01c99e280fa9592855885748b317fd66b994e469e92c64ed2b90ee15c930291b.dll,#1
  2⤵
  PID:2844