f4db3da0556e408eda7b6865daaf6f399fca4b826d1988a2c02a17a9c2eb3bf3

Analysis

max time kernel
157s
max time network
185s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 04:27

Target

f4db3da0556e408eda7b6865daaf6f399fca4b826d1988a2c02a17a9c2eb3bf3.dll
Size

32KB
MD5

5c89b8b70483dd8c400cc3ddbfa4d710
SHA1

4e06adae8e64519d4491249747b4fccc5f12d197
SHA256

f4db3da0556e408eda7b6865daaf6f399fca4b826d1988a2c02a17a9c2eb3bf3
SHA512

f2b043c77324ed223a7bf7a164ee1b2673e70b38258fe0c4b3d866f97171c51e4279b7e5b125521f1ddab717390ad453f552963216917a7d33c6461ea6743228
SSDEEP

384:rpuj39NfuKDQ/BFgbpoVCl8zjOvyzJW77+1O+qXSQG9aFJFrRCRNYY4p:lujru/O2Ml8zCSW7ADMSZ96BURNYYk

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3448 wrote to memory of 3416	3448	rundll32.exe	80
PID 3448 wrote to memory of 3416	3448	rundll32.exe	80
PID 3448 wrote to memory of 3416	3448	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f4db3da0556e408eda7b6865daaf6f399fca4b826d1988a2c02a17a9c2eb3bf3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f4db3da0556e408eda7b6865daaf6f399fca4b826d1988a2c02a17a9c2eb3bf3.dll,#1
  2⤵
  PID:3416