4bd4a868e5e483b5057681c57194e2e9be8078824b0574e9026eb3493fe484b5

Analysis

max time kernel
139s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 11:02

Target

4bd4a868e5e483b5057681c57194e2e9be8078824b0574e9026eb3493fe484b5.dll
Size

4KB
MD5

90b879758b5b6accecd10747c38120c0
SHA1

1d90e457e37e9a0520424e825a75698e3d6dbb6d
SHA256

4bd4a868e5e483b5057681c57194e2e9be8078824b0574e9026eb3493fe484b5
SHA512

9b97ab020a4207bf3904e26f7bdebc7a9e44ae962c2d53068bea7477bb20a44d75fa8397e6910a9bd58938d906c31ef4476eca51055eea0468b3e5b86a33c511
SSDEEP

24:eNGS5k4V4cW3Ce8WG/QPVGRVtq44MBZlZVtQ58kwVIaH40RWIcVI3SVrUYVq3uGP:a5zjMTGcITBVQVE1lcC3SVrd7oaC9Gg

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4808 wrote to memory of 3796	4808	rundll32.exe	80
PID 4808 wrote to memory of 3796	4808	rundll32.exe	80
PID 4808 wrote to memory of 3796	4808	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4bd4a868e5e483b5057681c57194e2e9be8078824b0574e9026eb3493fe484b5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4808
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4bd4a868e5e483b5057681c57194e2e9be8078824b0574e9026eb3493fe484b5.dll,#1
  2⤵
  PID:3796