0298542479a1e67a5fdde3a15419646ca163ec036b140f9ad5a5eea7bf8d6799

Analysis

max time kernel
90s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 06:58

Target

0298542479a1e67a5fdde3a15419646ca163ec036b140f9ad5a5eea7bf8d6799.dll
Size

4KB
MD5

2395f40270f0cad4de599e73dc59a700
SHA1

63ecf98a3ba5823eafdbd9e9addfaca174cc53c9
SHA256

0298542479a1e67a5fdde3a15419646ca163ec036b140f9ad5a5eea7bf8d6799
SHA512

c11f30eceb8cba391d234834bfce91baa1761b6fe8d000767bb0e014f8d6fc74235b54f9ae77b4e493a681eb1efa3b87823abb172b533e8fb3f731f5f7cc2c85
SSDEEP

48:iMHGv8j2IcW89NYEArhWHR0MiiIsiI6lXVkqlcH2SuiS6o+mm9u4z8W:PmkiIz8UZrQ0MhI/ITqly9u4zr

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 2040	2368	rundll32.exe	81
PID 2368 wrote to memory of 2040	2368	rundll32.exe	81
PID 2368 wrote to memory of 2040	2368	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0298542479a1e67a5fdde3a15419646ca163ec036b140f9ad5a5eea7bf8d6799.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0298542479a1e67a5fdde3a15419646ca163ec036b140f9ad5a5eea7bf8d6799.dll,#1
  2⤵
  PID:2040