74ef9640694cf8315b7b66e67ecbe101cc2aff8ed7dbfd9e250cfee3fbb7cc91

Analysis

max time kernel
289s
max time network
316s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 21:54

Target

74ef9640694cf8315b7b66e67ecbe101cc2aff8ed7dbfd9e250cfee3fbb7cc91.dll
Size

6KB
MD5

c65afb0e2465661bdc08e4aab81b6190
SHA1

0b5db9f697a55b200aa3df663cfcfd7104d0f071
SHA256

74ef9640694cf8315b7b66e67ecbe101cc2aff8ed7dbfd9e250cfee3fbb7cc91
SHA512

9c8f7e72c70eb9db1d65172db131a22c02a57fb3a1ef660b1e6ca969bde7b574c719341196b4861c4fb5f6ab5c07d81e002de527cc43f1447b79c10257330497
SSDEEP

96:nEY2RrF1eqwi4occRzunyRYx7VIrhQQFqoQ+91D9So9OyAqSF:EHRh1eppWJTrAoHJk

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 228 wrote to memory of 2920	228	rundll32.exe	81
PID 228 wrote to memory of 2920	228	rundll32.exe	81
PID 228 wrote to memory of 2920	228	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\74ef9640694cf8315b7b66e67ecbe101cc2aff8ed7dbfd9e250cfee3fbb7cc91.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:228
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\74ef9640694cf8315b7b66e67ecbe101cc2aff8ed7dbfd9e250cfee3fbb7cc91.dll,#1
  2⤵
  PID:2920