72ff334641a3dd3e64b614d2143579f8086ae3ab57e40da3c60181e2f46372ea

Analysis

max time kernel
92s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02-12-2022 02:18

Target

72ff334641a3dd3e64b614d2143579f8086ae3ab57e40da3c60181e2f46372ea.dll
Size

7KB
MD5

751591f5ed93d32e64ed3e27a409f0b0
SHA1

efa467fac6f48d16e47eedcfe1e2a0692708cc70
SHA256

72ff334641a3dd3e64b614d2143579f8086ae3ab57e40da3c60181e2f46372ea
SHA512

e9dc3b99d75aaf4be63ffd5bd39456f4598d003f727fb5181393a1164b38dced8900b860875d26db387c771a3bc91aa06a48731c437566cfcc1da48d39c8c5ef
SSDEEP

96:DixZjmjtjd8jPjcZGR5TIsXoCqsc9VwgkiOehschWbh+WLP:unSR6bgYvXoCqBV9kYhsXbhx

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4984 wrote to memory of 4840	4984	rundll32.exe	81
PID 4984 wrote to memory of 4840	4984	rundll32.exe	81
PID 4984 wrote to memory of 4840	4984	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\72ff334641a3dd3e64b614d2143579f8086ae3ab57e40da3c60181e2f46372ea.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4984
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\72ff334641a3dd3e64b614d2143579f8086ae3ab57e40da3c60181e2f46372ea.dll,#1
  2⤵
  PID:4840