59b38ab1788ab242739fa035cced6ff09be6511ac95bacfe345f6cc7e1b7ca74

Analysis

max time kernel
162s
max time network
183s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 02:24

Target

59b38ab1788ab242739fa035cced6ff09be6511ac95bacfe345f6cc7e1b7ca74.dll
Size

7KB
MD5

989316154fa503aa279e486b7dffe240
SHA1

0d84f736b70927dfc3c1420bdf67241bf3c66746
SHA256

59b38ab1788ab242739fa035cced6ff09be6511ac95bacfe345f6cc7e1b7ca74
SHA512

1c8d61fa0e30989acf327b5e3d345b4614ec3304b9d0391b7d7e73a831d50142bb26de2ca553fa8227165bbb4016b0a55a872af223dbad1f2a22300d33bed582
SSDEEP

96:DixZjmjtjd8jPjcZGR5TIEyHG+zyD16K0/ny8V52V6GVLlufDg7vndk+YgQZ0sW:unSR6bgYWXD5DG2uZW

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4888 wrote to memory of 380	4888	rundll32.exe	81
PID 4888 wrote to memory of 380	4888	rundll32.exe	81
PID 4888 wrote to memory of 380	4888	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\59b38ab1788ab242739fa035cced6ff09be6511ac95bacfe345f6cc7e1b7ca74.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\59b38ab1788ab242739fa035cced6ff09be6511ac95bacfe345f6cc7e1b7ca74.dll,#1
  2⤵
  PID:380