fb1065c87c97773d1ac1ffb44ad28db35664a871f3dc3d41a175a44e80ad5e50

Analysis

max time kernel
154s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02-12-2022 01:44

Target

fb1065c87c97773d1ac1ffb44ad28db35664a871f3dc3d41a175a44e80ad5e50.dll
Size

6KB
MD5

c95742825ae52c6321aeda71cc6e3220
SHA1

54907d79b1be793c68bca0f78807577becee5c1a
SHA256

fb1065c87c97773d1ac1ffb44ad28db35664a871f3dc3d41a175a44e80ad5e50
SHA512

d7ba957aee636cc830d51fc3b568ab01d74a276d2c96a1e626a62f26e6687218b440bc81339306fbfb93c84f65436c8b6ee478bc8e424737fb3ceb62ef737d1c
SSDEEP

48:C6Vo9HBok7lYa92RranDBetlG9Mg7PytvfnaIJi2g+1jDMaPfO86W4SgZf2o+uzC:nI2RrUeqtPo3np/JH04W22By36TE

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4848 wrote to memory of 4776	4848	rundll32.exe	81
PID 4848 wrote to memory of 4776	4848	rundll32.exe	81
PID 4848 wrote to memory of 4776	4848	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fb1065c87c97773d1ac1ffb44ad28db35664a871f3dc3d41a175a44e80ad5e50.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4848
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fb1065c87c97773d1ac1ffb44ad28db35664a871f3dc3d41a175a44e80ad5e50.dll,#1
  2⤵
  PID:4776