de231a47a18c36ed23fd9f43fb0fd9875eeca9db4af56b919e3880f2b52888be

Analysis

max time kernel
133s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 22:13

Target

de231a47a18c36ed23fd9f43fb0fd9875eeca9db4af56b919e3880f2b52888be.dll
Size

4KB
MD5

12f5cb3a1de4c84a796d0402715d8040
SHA1

6ce94724519de536a59980496dc4b31a80c5c1d9
SHA256

de231a47a18c36ed23fd9f43fb0fd9875eeca9db4af56b919e3880f2b52888be
SHA512

e8dec11f45444c38fee21b7eccc046cd3576bb1d415b55ba00b54e4651d3241190667cffd386f423ad5e4941867e8902f83e7a50ef39a38a1da8b85ba40e9180
SSDEEP

48:SWkO0IoyTnXz+ihZjokcZp6B1R2/Iba8EokxD:ZJTnXzvokB7R2/IbeokB

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4964 wrote to memory of 4988	4964	rundll32.exe	31
PID 4964 wrote to memory of 4988	4964	rundll32.exe	31
PID 4964 wrote to memory of 4988	4964	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\de231a47a18c36ed23fd9f43fb0fd9875eeca9db4af56b919e3880f2b52888be.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4964
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\de231a47a18c36ed23fd9f43fb0fd9875eeca9db4af56b919e3880f2b52888be.dll,#1
  2⤵
  PID:4988