1ff7fd741c44abe84dd302fd9ca67017b0590cffe462f9b79a4f7334d854feb6

Analysis

max time kernel
134s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 19:31

Target

1ff7fd741c44abe84dd302fd9ca67017b0590cffe462f9b79a4f7334d854feb6.dll
Size

72KB
MD5

e105e99004710c914707c4b47b485fa0
SHA1

e570e645605617fbd0a30bf478800284e356e290
SHA256

1ff7fd741c44abe84dd302fd9ca67017b0590cffe462f9b79a4f7334d854feb6
SHA512

1047ab5b0a344c4ce340f0cee8b4301b0a86b7a97b93918c100f9f811f1e7dcdb896dd5e8d88a8b366b78a42dcdf41b0624e463b3dedb2a56ad94b88786f50a3
SSDEEP

1536:mPO6KEVbsVP0gyVZOiSEqBW2U1aM/mdaWRqvEQCdUvGe/TsGdQ:cMEVbsVcuEqs172hACdUvGeYGdQ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4872 wrote to memory of 4980	4872	rundll32.exe	81
PID 4872 wrote to memory of 4980	4872	rundll32.exe	81
PID 4872 wrote to memory of 4980	4872	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1ff7fd741c44abe84dd302fd9ca67017b0590cffe462f9b79a4f7334d854feb6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4872
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1ff7fd741c44abe84dd302fd9ca67017b0590cffe462f9b79a4f7334d854feb6.dll,#1
  2⤵
  PID:4980