fea4993a27ef7eb3aac229053bd5f429790144c3684e2bdf128558da1faf1081

Analysis

max time kernel
146s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 10:42

Target
fea4993a27ef7eb3aac229053bd5f429790144c3684e2bdf128558da1faf1081.dll
Size 32KB
Sample221203-mrzbysce95
SHA256 fea4993a27ef7eb3aac229053bd5f429790144c3684e2bdf128558da1faf1081
MD5 674344fe9c0654af92e87a27f779931b
SHA1 2b97fba826465fab9225caee4515cf8f2e784b63
SHA512 68b275675e8dbc01e1ccf4aa4e73402b81dea3adef877e60868c56ca2824775ade71ca1ee5502a2edf3ecb807440fded6bca91d6a2f8f18927953de0a93978ac
SSDEEP 768:KN/CMPCo5t+dOpk7Vz7LPT1IShVD8R96Cs4:KN/CMPCA4Oe57LrXHARF/
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4524 wrote to memory of 2400	4524	rundll32.exe	82
PID 4524 wrote to memory of 2400	4524	rundll32.exe	82
PID 4524 wrote to memory of 2400	4524	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fea4993a27ef7eb3aac229053bd5f429790144c3684e2bdf128558da1faf1081.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4524
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fea4993a27ef7eb3aac229053bd5f429790144c3684e2bdf128558da1faf1081.dll,#1
  2⤵
  PID:2400