324f71632fa09da3f8ae5c6a7eb4d763498f7f5e3c199949c256b3f6aea9a1c9

Analysis

max time kernel
146s
max time network
170s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 23:15

Target

324f71632fa09da3f8ae5c6a7eb4d763498f7f5e3c199949c256b3f6aea9a1c9.dll
Size

6KB
MD5

0aae1bb2f1c5ea50892d3c7ee62ee280
SHA1

2464684a32e7c7e5eb77f9a0be9a95fad4a2416b
SHA256

324f71632fa09da3f8ae5c6a7eb4d763498f7f5e3c199949c256b3f6aea9a1c9
SHA512

39bee74a1b9ffafbbc78bb3ede3b47a8dce36aaaf4279ff4762c98a0934bbe9b9a33b845ef1d1750515df284055956311d59ef475741bafb66e0d1d78dca9ee8
SSDEEP

48:a5zJjO9/2uxBAKtklS4OiklShklSK8klS3klSTIZGTviietylAPwq5cGPw5JObEw:Hxvtj+jhjvj3jcZGOiIY1oCGUyN

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 4568	2240	rundll32.exe	79
PID 2240 wrote to memory of 4568	2240	rundll32.exe	79
PID 2240 wrote to memory of 4568	2240	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\324f71632fa09da3f8ae5c6a7eb4d763498f7f5e3c199949c256b3f6aea9a1c9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\324f71632fa09da3f8ae5c6a7eb4d763498f7f5e3c199949c256b3f6aea9a1c9.dll,#1
  2⤵
  PID:4568