70fcf186c618a6da16ad3790c469243402380620d692d263349746a8c9b1f314

Analysis

max time kernel
290s
max time network
360s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 11:01

Target

70fcf186c618a6da16ad3790c469243402380620d692d263349746a8c9b1f314.dll
Size

4KB
MD5

69a535a42970237bf8b852ab7e706b60
SHA1

cd2bb9f9a4657332363e6a31d8574f30ffabae7d
SHA256

70fcf186c618a6da16ad3790c469243402380620d692d263349746a8c9b1f314
SHA512

acdf7ccca1ebbc404d2eab12181cf51e2fab61718e0ff230a8710f19ce3bd0b69acb1f7d3981540697e4e0c04f95309f03e42e1ef9d33fc5949c40b6ebd18504
SSDEEP

48:a5zjMTGcITBVQVE1lcEc4FHFtmRdIhaQ0NLqhn:iT3Qu8EcaCdIhaQ00h

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 4640	2248	rundll32.exe	81
PID 2248 wrote to memory of 4640	2248	rundll32.exe	81
PID 2248 wrote to memory of 4640	2248	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\70fcf186c618a6da16ad3790c469243402380620d692d263349746a8c9b1f314.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\70fcf186c618a6da16ad3790c469243402380620d692d263349746a8c9b1f314.dll,#1
  2⤵
  PID:4640