b3fcedc28875079e8e288589d48b36a5c00d5057f29a60051891301a8a07b0bf

Analysis

max time kernel
91s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 03:07

Target

b3fcedc28875079e8e288589d48b36a5c00d5057f29a60051891301a8a07b0bf.dll
Size

59KB
MD5

fb87487ef8cc1238001f62d4c9a55ba9
SHA1

91dcced1828b6e76111f806a17d97fdfacdbf22d
SHA256

b3fcedc28875079e8e288589d48b36a5c00d5057f29a60051891301a8a07b0bf
SHA512

f18df109344ef90d44a5dd871e33e8610ff901f5595dcdf53569a6c212c3b53a7e996fdeb81419fd73a58868e99f3cf139179c38de805e7266da3ce33d26ec1f
SSDEEP

1536:n7ZLNPp9pZBMAMcbj1/GRmE3sZFDaEx0cnPaQP1nZUHQET:7ZppUg/GOrDxdasKQ6

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2468	2180	rundll32.exe	79
PID 2180 wrote to memory of 2468	2180	rundll32.exe	79
PID 2180 wrote to memory of 2468	2180	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b3fcedc28875079e8e288589d48b36a5c00d5057f29a60051891301a8a07b0bf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b3fcedc28875079e8e288589d48b36a5c00d5057f29a60051891301a8a07b0bf.dll,#1
  2⤵
  PID:2468