374494816fa7b1790012d283f63fb6829005b27da3c1b01356d61aa52b8c9f90

Analysis

max time kernel
100s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 23:15

Target

374494816fa7b1790012d283f63fb6829005b27da3c1b01356d61aa52b8c9f90.dll
Size

6KB
MD5

3cb0e72281df1e02f9f69d74d4aabf70
SHA1

24b2f77e46700ff3f9cd08ff6188c4f8dd3dd4b4
SHA256

374494816fa7b1790012d283f63fb6829005b27da3c1b01356d61aa52b8c9f90
SHA512

5e006351be63bbcd7bd7061c0b8daac274b3cfdf5469b963e8abae35a2bb101b901c139e3a4cf6c97e4ca841eec1525b1ad3890c45b7fb0c62fa065454669931
SSDEEP

96:hyZxm/jmjhjvj3jcZGV4LWxgD93oh0bY3mzrKN4S2q:2M/SdjbgYvh0wrH

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 4904	1988	rundll32.exe	81
PID 1988 wrote to memory of 4904	1988	rundll32.exe	81
PID 1988 wrote to memory of 4904	1988	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\374494816fa7b1790012d283f63fb6829005b27da3c1b01356d61aa52b8c9f90.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\374494816fa7b1790012d283f63fb6829005b27da3c1b01356d61aa52b8c9f90.dll,#1
  2⤵
  PID:4904