391f29273a23dca548f9cb2935d6231ad395607f37523f20a4bb133eda1deea6

Analysis

max time kernel
148s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02-12-2022 00:11

Target

391f29273a23dca548f9cb2935d6231ad395607f37523f20a4bb133eda1deea6.dll
Size

136KB
MD5

66b79003dc6413891be57435fc48f950
SHA1

77fd4dba1cfadc13fe7371c2b83daeaf514337e7
SHA256

391f29273a23dca548f9cb2935d6231ad395607f37523f20a4bb133eda1deea6
SHA512

57379b917321d3327c8053e9283926348c08435b18ff15592fee3b026841708e220d1aed65e8283d626a548e971a570164f6c79a78fd4b86e589e1bdf3dadb66
SSDEEP

3072:s8wA0/MPNtg1ygFG6XQ0/syVpILTQygewGOog720ImG:s8wuPQJ2tukg0

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 1640	2800	rundll32.exe	82
PID 2800 wrote to memory of 1640	2800	rundll32.exe	82
PID 2800 wrote to memory of 1640	2800	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\391f29273a23dca548f9cb2935d6231ad395607f37523f20a4bb133eda1deea6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\391f29273a23dca548f9cb2935d6231ad395607f37523f20a4bb133eda1deea6.dll,#1
  2⤵
  PID:1640