a38c2ecbdc6141522bc0b820769cb086f9aa1b1bd7b85a5ef168c4f86e5c09ec

Analysis

max time kernel
91s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
02-12-2022 19:19

Target

a38c2ecbdc6141522bc0b820769cb086f9aa1b1bd7b85a5ef168c4f86e5c09ec.dll
Size

73KB
MD5

f5b4a7860f3f6b46a8eb48a101076051
SHA1

32981c6db0cdeaa508d4cfa38efeeb206e393aa6
SHA256

a38c2ecbdc6141522bc0b820769cb086f9aa1b1bd7b85a5ef168c4f86e5c09ec
SHA512

3edd29fc55bf0e84554976360c1c5c2ed65bd71a8e1a88a39433cb7c5c202dbbe3b49556c5e03b24eb1657f2643daebc20b4f0dd2756014377542fb80746ee5d
SSDEEP

1536:Bm1NGJVGP8bRoKWNZDEQYymxBFoKiBm0IQ60osJhse:kX0Vr9hceQeFo00/6Kue

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4940 wrote to memory of 4988	4940	rundll32.exe	81
PID 4940 wrote to memory of 4988	4940	rundll32.exe	81
PID 4940 wrote to memory of 4988	4940	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a38c2ecbdc6141522bc0b820769cb086f9aa1b1bd7b85a5ef168c4f86e5c09ec.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a38c2ecbdc6141522bc0b820769cb086f9aa1b1bd7b85a5ef168c4f86e5c09ec.dll,#1
  2⤵
  PID:4988