fbb4c78bfbb3c19f7f5d6b2fac57994148666ff8e1093e376236ce878807e340

Analysis

max time kernel
183s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 23:53

Target

fbb4c78bfbb3c19f7f5d6b2fac57994148666ff8e1093e376236ce878807e340.dll
Size

18KB
MD5

522cfcaadcbfaecec5201a35305d2e46
SHA1

febf910cc85e5f8446d4948937e879c2fca7f597
SHA256

fbb4c78bfbb3c19f7f5d6b2fac57994148666ff8e1093e376236ce878807e340
SHA512

b77137b198fcf72871b93a8fe88124fbc8ced90a6e865811f53f26ea5f055b3388d98f797053ecf4a337b16e92748100fa3932e668d3f1358e33400a64152ad4
SSDEEP

384:fI9LKqMe3zYv2fQikM9y2bNV5oD62GioHmzqhFr:k4QY+x5V5oe2RoGGD

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 1060	2792	rundll32.exe	82
PID 2792 wrote to memory of 1060	2792	rundll32.exe	82
PID 2792 wrote to memory of 1060	2792	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fbb4c78bfbb3c19f7f5d6b2fac57994148666ff8e1093e376236ce878807e340.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fbb4c78bfbb3c19f7f5d6b2fac57994148666ff8e1093e376236ce878807e340.dll,#1
  2⤵
  PID:1060