d1a118e14adddf63b9c925372f31160a3a3c29a92e2f7f0112f19218b578509b

Analysis

max time kernel
91s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 03:53

Target

d1a118e14adddf63b9c925372f31160a3a3c29a92e2f7f0112f19218b578509b.dll
Size

59KB
MD5

60ddc080b50715c7c65927d5f7256b93
SHA1

7168def54d1470b92e094797c62f94dbdd445467
SHA256

d1a118e14adddf63b9c925372f31160a3a3c29a92e2f7f0112f19218b578509b
SHA512

299e48c34a87bb4b34a1a8c37457139c55793c4de5a82e73cc34320b7ed154cc35a1a988f70741f0361e4784a1f471b2613773193cc5854d31e13d75462cf0eb
SSDEEP

768:GbvLDaaMact8TXDXlXdQC6etlH4SMbLPIqQXMdzZwspZoKg6GjO0oEDmg7ym:evrDtd68N7MbzIqcoFZ+6GR3Ym

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4864 wrote to memory of 4796	4864	rundll32.exe	80
PID 4864 wrote to memory of 4796	4864	rundll32.exe	80
PID 4864 wrote to memory of 4796	4864	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d1a118e14adddf63b9c925372f31160a3a3c29a92e2f7f0112f19218b578509b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4864
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d1a118e14adddf63b9c925372f31160a3a3c29a92e2f7f0112f19218b578509b.dll,#1
  2⤵
  PID:4796