2dca8f39644b846164d8435ac59ad10b2aa2a0da75443730085707c3e853a653

Analysis

max time kernel
91s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 01:39

Target

2dca8f39644b846164d8435ac59ad10b2aa2a0da75443730085707c3e853a653.dll
Size

6KB
MD5

e56070b674c748c0b8ce31236b4c54b0
SHA1

95cd4038005ee4670bb3f34ce71ad16d22436933
SHA256

2dca8f39644b846164d8435ac59ad10b2aa2a0da75443730085707c3e853a653
SHA512

fb52df11b89dc3dbbd0b5a49f1a9376f60362cb58682e1c2cbd728548d753e528e0d2b31662f57ac64b3301e0c6084f44b424e8c4b8917b9e50a462047172be7
SSDEEP

192:EHRh1eppOuMBJaJEt2lZiluJEJ9BJZZaRIUBFl:EHROpMtAe90OU

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4996 wrote to memory of 396	4996	rundll32.exe	81
PID 4996 wrote to memory of 396	4996	rundll32.exe	81
PID 4996 wrote to memory of 396	4996	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2dca8f39644b846164d8435ac59ad10b2aa2a0da75443730085707c3e853a653.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4996
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2dca8f39644b846164d8435ac59ad10b2aa2a0da75443730085707c3e853a653.dll,#1
  2⤵
  PID:396