1b1790c28672daa71e11f4d9d51181ebe66cf6f335333a86f254176e56fed24b

Analysis

max time kernel
151s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 19:17

Target

1b1790c28672daa71e11f4d9d51181ebe66cf6f335333a86f254176e56fed24b.dll
Size

64KB
MD5

e46ec5df50f2cebf3034ca12fff7ae30
SHA1

c7a2ef358693cf2c2271644279c9a45f4f8dbfe7
SHA256

1b1790c28672daa71e11f4d9d51181ebe66cf6f335333a86f254176e56fed24b
SHA512

ad5b747a8ec65755058a004b1fc2dedbe61a4631c2f2dbd246d9b661543b839fb21bc0f4bc416df6fbe8613e49463a4133f947e4b1854ada028002764a374cca
SSDEEP

1536:5jRmOWn9CFJLxojbpigb1UWgMJAP94ucWo0NB6h:xfjNoj9igbbUz6Z

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 1540	2276	rundll32.exe	85
PID 2276 wrote to memory of 1540	2276	rundll32.exe	85
PID 2276 wrote to memory of 1540	2276	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1b1790c28672daa71e11f4d9d51181ebe66cf6f335333a86f254176e56fed24b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1b1790c28672daa71e11f4d9d51181ebe66cf6f335333a86f254176e56fed24b.dll,#1
  2⤵
  PID:1540