144bae992c101b6f9198537f93f08c2c2801c1ca592b02ce889917a895d654a6

Analysis

max time kernel
167s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 00:51

Target

144bae992c101b6f9198537f93f08c2c2801c1ca592b02ce889917a895d654a6.dll
Size

33KB
MD5

d78130f74d861ae52607884312c6dae2
SHA1

2d06343a7c1dc08f1b0d2cdb72d9a6db110d01c1
SHA256

144bae992c101b6f9198537f93f08c2c2801c1ca592b02ce889917a895d654a6
SHA512

7fe864e1020ba39c4d9cb435aa8dfaa6227ed8da55a2dfd99e5b3f679d132c933050b523ab571f8544146dd3b534005911bc50750d4143982e819d1f36891053
SSDEEP

768:l7v1b7TDuSxa/0xyDcl27l5+uMSVOiuGROku9A:lz1b9a/3A47l5+uVFRFu+

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3276 wrote to memory of 1796	3276	rundll32.exe	79
PID 3276 wrote to memory of 1796	3276	rundll32.exe	79
PID 3276 wrote to memory of 1796	3276	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\144bae992c101b6f9198537f93f08c2c2801c1ca592b02ce889917a895d654a6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3276
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\144bae992c101b6f9198537f93f08c2c2801c1ca592b02ce889917a895d654a6.dll,#1
  2⤵
  PID:1796