386ce12c412744e9d1e846c4479eee045b0d6270debcac00c034c8708bb9b9c1

Analysis

max time kernel
151s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 19:21

Target

386ce12c412744e9d1e846c4479eee045b0d6270debcac00c034c8708bb9b9c1.dll
Size

56KB
MD5

61949170455fbedfcb65569a00a66ba0
SHA1

675ff23c0b132975d93491519e015ec549412ac2
SHA256

386ce12c412744e9d1e846c4479eee045b0d6270debcac00c034c8708bb9b9c1
SHA512

eebb290b2ddeb2869aa8280f03c2d8c57db6d2b0b54a89dcaff0b36ed5b977fd29da596d74ab05b003c1c2f262dc8caa15c2ca5d9fb13094b779baad7f5fc51a
SSDEEP

1536:Bm1NGJVGyU/TL7nLAK8Acb69vIL2zH+ZcyWSetzIu:kX0VDU/TL7nLub+vICYT1u

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5100 wrote to memory of 1236	5100	rundll32.exe	81
PID 5100 wrote to memory of 1236	5100	rundll32.exe	81
PID 5100 wrote to memory of 1236	5100	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\386ce12c412744e9d1e846c4479eee045b0d6270debcac00c034c8708bb9b9c1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5100
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\386ce12c412744e9d1e846c4479eee045b0d6270debcac00c034c8708bb9b9c1.dll,#1
  2⤵
  PID:1236