b21fc59d7f385e279df831d334031d7cfcd4c79f355958038678f3d5e7ee0a79

Analysis

max time kernel
192s
max time network
210s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 22:31

Target

b21fc59d7f385e279df831d334031d7cfcd4c79f355958038678f3d5e7ee0a79.dll
Size

6KB
MD5

7b6e843cccaa53df42ae8cd2e80cf830
SHA1

308e7f4ef981cedeb2f5343ba80dd36d5d6176f0
SHA256

b21fc59d7f385e279df831d334031d7cfcd4c79f355958038678f3d5e7ee0a79
SHA512

0cae3fea81cd4a323860999904fea34bbc36d0b8cd3a317264e2e35f9486165d75e64de567770d4e46821c94f3c73e9bc6d394ed2087ea534d284a582e0b987e
SSDEEP

192:2M/SdjbgYwsnO7ot50ARIy2YTOVZVohS0NGQ:23wpkt50AR52YTOZVoQ0NGQ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1392 wrote to memory of 1516	1392	rundll32.exe	81
PID 1392 wrote to memory of 1516	1392	rundll32.exe	81
PID 1392 wrote to memory of 1516	1392	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b21fc59d7f385e279df831d334031d7cfcd4c79f355958038678f3d5e7ee0a79.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1392
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b21fc59d7f385e279df831d334031d7cfcd4c79f355958038678f3d5e7ee0a79.dll,#1
  2⤵
  PID:1516