c47de4934e92d6cb6da6275567281c5862d24a9623f33d1d3e5b3c7dfaf4da5c

Analysis

max time kernel
137s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 01:27

Target

c47de4934e92d6cb6da6275567281c5862d24a9623f33d1d3e5b3c7dfaf4da5c.dll
Size

84KB
MD5

97074a9b5a80d9af1530eb483147e8a7
SHA1

ded2aa7e40e750005709ec0c64ea7ca6efaaf364
SHA256

c47de4934e92d6cb6da6275567281c5862d24a9623f33d1d3e5b3c7dfaf4da5c
SHA512

c84f4c919c6fa6840b9d418a6835abb2ae1ac103e65410f5e2b3b455c4ea30e4dc6c7630cf7c7ad1d127f15d07221f5da946e85f1af3d1ba352a382dc687a70b
SSDEEP

1536:T8GBO+L0wgRDCdTXNzMLT8DafNPC+iAZsGHudCo6nxk:lX0wWDCyya2AQdCo6nx

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3780 wrote to memory of 4628	3780	rundll32.exe	79
PID 3780 wrote to memory of 4628	3780	rundll32.exe	79
PID 3780 wrote to memory of 4628	3780	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c47de4934e92d6cb6da6275567281c5862d24a9623f33d1d3e5b3c7dfaf4da5c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3780
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c47de4934e92d6cb6da6275567281c5862d24a9623f33d1d3e5b3c7dfaf4da5c.dll,#1
  2⤵
  PID:4628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4628 -ip 4628
1⤵
PID:4832