2e241ccaca9223fafeda03d1b5e2c576400625c33d298e7ff6e8251b2abe98ec

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 23:16

Target

2e241ccaca9223fafeda03d1b5e2c576400625c33d298e7ff6e8251b2abe98ec.dll
Size

4KB
MD5

c2152a70259914ad1f571d2aa7053e20
SHA1

341cb2f2632916569d3dfd3df5675b43ea7ed335
SHA256

2e241ccaca9223fafeda03d1b5e2c576400625c33d298e7ff6e8251b2abe98ec
SHA512

7f12af856b9ec904cf3a9c15168da9767d18ebd21bc1efdb39dc0ef903cfd9b4622136e27e422f773ae49a345026ecd9e654701e995be5c97aff488095247ad8
SSDEEP

48:a5zuMqBcq06phM/wwWLSeJY8JTa6Il+LhNXnwBfUUkZJNONXFV0Vg4:TRphMzf8hNXaFkZTaVV0VB

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1420 wrote to memory of 4984	1420	rundll32.exe	81
PID 1420 wrote to memory of 4984	1420	rundll32.exe	81
PID 1420 wrote to memory of 4984	1420	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2e241ccaca9223fafeda03d1b5e2c576400625c33d298e7ff6e8251b2abe98ec.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1420
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2e241ccaca9223fafeda03d1b5e2c576400625c33d298e7ff6e8251b2abe98ec.dll,#1
  2⤵
  PID:4984