8d2b8f04a9d3a441a6ea230e9fd27216d5b30a31908dfb5c0d0e135a8e2bcd81

Analysis

max time kernel
138s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 02:11

Target

8d2b8f04a9d3a441a6ea230e9fd27216d5b30a31908dfb5c0d0e135a8e2bcd81.dll
Size

7KB
MD5

d267e37c2956bd5ef34142c8e1cd4fa0
SHA1

58e8ea400dcf86aa9c48f07b25dd77c3dde4eafc
SHA256

8d2b8f04a9d3a441a6ea230e9fd27216d5b30a31908dfb5c0d0e135a8e2bcd81
SHA512

5da7a6a96b3e690d2e0818700f4dc02fca2b0a66857fe07d0344c7fb250a0ff8751dbba5e8fdc58be40aa91abb65bbd57c52370a17f5abe447381b20f7261e65
SSDEEP

96:FlWrYDpKnI6wJ+Ls7guyHejyn/I9l0ik/M1ruyoVVB6gkLmkl9A8:Fl1cA+ggd+W/If0ik/MST5kLmIA8

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3836 wrote to memory of 916	3836	rundll32.exe	80
PID 3836 wrote to memory of 916	3836	rundll32.exe	80
PID 3836 wrote to memory of 916	3836	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8d2b8f04a9d3a441a6ea230e9fd27216d5b30a31908dfb5c0d0e135a8e2bcd81.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3836
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8d2b8f04a9d3a441a6ea230e9fd27216d5b30a31908dfb5c0d0e135a8e2bcd81.dll,#1
  2⤵
  PID:916