2d471960c32575b76c5e0d78e7bd0aa420fa4a81a8f3f4115238040d58a3d3b5

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 02:21

Target

2d471960c32575b76c5e0d78e7bd0aa420fa4a81a8f3f4115238040d58a3d3b5.dll
Size

15KB
MD5

d339f0dbaa0f68aecf6c426001a835f0
SHA1

9a25f05d01ceb336553b7fcf57bb531dfda1b03a
SHA256

2d471960c32575b76c5e0d78e7bd0aa420fa4a81a8f3f4115238040d58a3d3b5
SHA512

f93048832322a2a7d5bfc60bbae562d1f1b293740ec4421ff57c76f857ffdf26561e9c213dd3a4a40046c8ebf0ae1e6f789afb0ae2b3395b8efedc6a13e4b300
SSDEEP

192:SC0itFaWlB2SYxmJzTQsoHImVigU6d984blsckwLsBb/d6T+z9SCqGfFMKB:SCb662ZWzh3ws1Jb/KU9SCq8FMKB

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 3136	2820	rundll32.exe	79
PID 2820 wrote to memory of 3136	2820	rundll32.exe	79
PID 2820 wrote to memory of 3136	2820	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2d471960c32575b76c5e0d78e7bd0aa420fa4a81a8f3f4115238040d58a3d3b5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2d471960c32575b76c5e0d78e7bd0aa420fa4a81a8f3f4115238040d58a3d3b5.dll,#1
  2⤵
  PID:3136