26601d979677937f58070a7d459881a826d89e7b4901d50c3bcf85fbe50c8797

Analysis

max time kernel
136s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 11:24

Target

26601d979677937f58070a7d459881a826d89e7b4901d50c3bcf85fbe50c8797.dll
Size

161KB
MD5

8a9d0da64e5dc18dd5d0a8492b72b28c
SHA1

b797181f840899cf2eb240e20814d95fedc5cb88
SHA256

26601d979677937f58070a7d459881a826d89e7b4901d50c3bcf85fbe50c8797
SHA512

ef7f59ed010686e316478f4953c1067f28db117ed2c11f7fadcd5ef8601f4f3518767c8d07b1503929d4b36ffd0f8255465fab9bd079d5cf5b2f883d9e2d705e
SSDEEP

3072:Y0aK/6Ue1rR1gxZR+V3TzfOIsUgpSYISpUDHHf5X71B:La9rJR1gxGVDDOIsUgMYxpQHHZZB

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5072 wrote to memory of 2052	5072	rundll32.exe	83
PID 5072 wrote to memory of 2052	5072	rundll32.exe	83
PID 5072 wrote to memory of 2052	5072	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\26601d979677937f58070a7d459881a826d89e7b4901d50c3bcf85fbe50c8797.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\26601d979677937f58070a7d459881a826d89e7b4901d50c3bcf85fbe50c8797.dll,#1
  2⤵
  PID:2052