e44fab572453c70103efef90b9802578eb54ac8a0008a071162574808b34162e

Analysis

max time kernel
181s
max time network
196s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 22:10

Target

e44fab572453c70103efef90b9802578eb54ac8a0008a071162574808b34162e.dll
Size

4KB
MD5

ec85c726dcb2be90ce644c0a2c9ae530
SHA1

45d107eb14e89e2b5bd62cdd67502664ec3d538c
SHA256

e44fab572453c70103efef90b9802578eb54ac8a0008a071162574808b34162e
SHA512

b2387620d129b618b1c0670e887c84b760312b908b2cddadf83d5ea6813ddb698ce94712cfc3ace57d3f714d1767a09e78e911ab052d3fa46cc793729df93669
SSDEEP

48:a5zuMqBcq06phM/wwWLSeJY8JTa6Il+LpCqA03NU1kJK4D6zN+4v4sGtRo9oH9U:TRphMzf8sqAd1kWzsORGt/9U

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3664 wrote to memory of 1996	3664	rundll32.exe	83
PID 3664 wrote to memory of 1996	3664	rundll32.exe	83
PID 3664 wrote to memory of 1996	3664	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e44fab572453c70103efef90b9802578eb54ac8a0008a071162574808b34162e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3664
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e44fab572453c70103efef90b9802578eb54ac8a0008a071162574808b34162e.dll,#1
  2⤵
  PID:1996