db368e0224b138fb575c5f088b53ac0e03a8648e916ca820088bbb21c7176b5e

Analysis

max time kernel
157s
max time network
177s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02-12-2022 19:17

Target

db368e0224b138fb575c5f088b53ac0e03a8648e916ca820088bbb21c7176b5e.dll
Size

66KB
MD5

23f4d2ba95c2c238368233d7a1782050
SHA1

2866691c588482c778d54d8f10bdff88a3b36bf1
SHA256

db368e0224b138fb575c5f088b53ac0e03a8648e916ca820088bbb21c7176b5e
SHA512

c479babd2e6fdb3bdc1663cfc2aa2b905f23cd9375a7269dbcbab4ba7a7a56ba5a46a7ea00ed850c9628db8003ec53b38e3d97bce8861884f1f480a1d5b41a00
SSDEEP

1536:2LOJMXV6OKFcDjpNAMkfKpllDcVQnSR+kDJkQ0Sle/ce:2rkdFcDlKMkfKfnSR+kDCQ0S0N

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4144 wrote to memory of 404	4144	rundll32.exe	79
PID 4144 wrote to memory of 404	4144	rundll32.exe	79
PID 4144 wrote to memory of 404	4144	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\db368e0224b138fb575c5f088b53ac0e03a8648e916ca820088bbb21c7176b5e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4144
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\db368e0224b138fb575c5f088b53ac0e03a8648e916ca820088bbb21c7176b5e.dll,#1
  2⤵
  PID:404