e489d4b3b22a67b6112166a19c123617ae0d963b8925223b403de4d6834bcd6b

Analysis

max time kernel
152s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02-12-2022 01:49

Target

e489d4b3b22a67b6112166a19c123617ae0d963b8925223b403de4d6834bcd6b.dll
Size

6KB
MD5

70b06bb4ed2b53e48658e135c6f9c410
SHA1

1f5f4773f580084aec4c097358fb36a368d2c44e
SHA256

e489d4b3b22a67b6112166a19c123617ae0d963b8925223b403de4d6834bcd6b
SHA512

a3afa9f39a05159c3f293f535d985c74caf791c5397bc65b2ba1300788d2dd408ea2eba97636d69d834719991d42a25ca7f384448fbe8dd05b30f11b948fe55c
SSDEEP

96:Ts1Wnnnynnnnnnnn6nnann7nnXnnbnnKniROU+0jBVB4:YXF+y

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 2260	2472	rundll32.exe	82
PID 2472 wrote to memory of 2260	2472	rundll32.exe	82
PID 2472 wrote to memory of 2260	2472	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e489d4b3b22a67b6112166a19c123617ae0d963b8925223b403de4d6834bcd6b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e489d4b3b22a67b6112166a19c123617ae0d963b8925223b403de4d6834bcd6b.dll,#1
  2⤵
  PID:2260