c16f1dcad5a1b1e83ab8b9fd5e249d4236d3a9e94a5b5fe7646a2db22f6e3372

Analysis

max time kernel
146s
max time network
187s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 17:24

Target

c16f1dcad5a1b1e83ab8b9fd5e249d4236d3a9e94a5b5fe7646a2db22f6e3372.dll
Size

40KB
MD5

3cfd70d234399fd7d5bf4bc9c489bacc
SHA1

a0fc25c70cfd490e605e0f438e8ad6ae5dc35e47
SHA256

c16f1dcad5a1b1e83ab8b9fd5e249d4236d3a9e94a5b5fe7646a2db22f6e3372
SHA512

30bcdc60364c9b036abaaa9f3297669e5f37826d920d9213055f9448317b5349396580a9b3c98e8d4190040ed66c6161f991af93d56e4cbb492ff6a4508b8fee
SSDEEP

768:fJin9YHEco5yOr9iUHrkHz4sSVETg7yff9Iuzuen+:fJi0QyO5zezXZTg7yH9Qe

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4676 wrote to memory of 2956	4676	rundll32.exe	79
PID 4676 wrote to memory of 2956	4676	rundll32.exe	79
PID 4676 wrote to memory of 2956	4676	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c16f1dcad5a1b1e83ab8b9fd5e249d4236d3a9e94a5b5fe7646a2db22f6e3372.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4676
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c16f1dcad5a1b1e83ab8b9fd5e249d4236d3a9e94a5b5fe7646a2db22f6e3372.dll,#1
  2⤵
  PID:2956