88056b3249ad1988eb1e4b86d83191eaf48f36e0888741a1c5c570d1a443486b

Analysis

max time kernel
189s
max time network
201s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 19:24

Target

88056b3249ad1988eb1e4b86d83191eaf48f36e0888741a1c5c570d1a443486b.dll
Size

62KB
MD5

fd96d49117c8ae5d2022b595729b4ff9
SHA1

56e907ef5d09de2ad192ebcc531ecbb17076e327
SHA256

88056b3249ad1988eb1e4b86d83191eaf48f36e0888741a1c5c570d1a443486b
SHA512

d3d2e55a2bea44aecbbb673732938757f13ed8f8787e7771b0199a542f42f1fc932ea403ec60422e4c38c25a79e20a79a44ac84a6bbbb49aa435203c25243438
SSDEEP

1536:yHZB03+ERkw2tmAxRkzjd68EC3Bm+avWeUHm:yHf03+ERkFtmZzEAB8vWeym

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4092 wrote to memory of 4124	4092	rundll32.exe	81
PID 4092 wrote to memory of 4124	4092	rundll32.exe	81
PID 4092 wrote to memory of 4124	4092	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\88056b3249ad1988eb1e4b86d83191eaf48f36e0888741a1c5c570d1a443486b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4092
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\88056b3249ad1988eb1e4b86d83191eaf48f36e0888741a1c5c570d1a443486b.dll,#1
  2⤵
  PID:4124