59f6f10a3491210847f04d116b91f104987b0d4230ab05bacd814cd1f2d0af4c

Analysis

max time kernel
152s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 23:06

Target

59f6f10a3491210847f04d116b91f104987b0d4230ab05bacd814cd1f2d0af4c.dll
Size

6KB
MD5

303dbf9a22655f9e24e5bca8598bb030
SHA1

da67f9a03328c31c76ba5c08175be73579285051
SHA256

59f6f10a3491210847f04d116b91f104987b0d4230ab05bacd814cd1f2d0af4c
SHA512

a4752078cc2219d7a2ed4a6ceebe8989049b99ac6d030b0cc9402908a8a46d48c380a98ad2b95df05fa83ad542e413fcaa774c584f06ac52f9aaeae57dc05509
SSDEEP

48:StLHOj98/a6xkklS4zklStklSd8klSPklSTIZGjiiDlGYocf:WLRxkjujtjd8jPjcZG2Uo

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4904 wrote to memory of 3100	4904	rundll32.exe	81
PID 4904 wrote to memory of 3100	4904	rundll32.exe	81
PID 4904 wrote to memory of 3100	4904	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\59f6f10a3491210847f04d116b91f104987b0d4230ab05bacd814cd1f2d0af4c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\59f6f10a3491210847f04d116b91f104987b0d4230ab05bacd814cd1f2d0af4c.dll,#1
  2⤵
  PID:3100