d691bc59ccfe027b9ee01a7a2208af315eec9a69d5e6f0c5f07554a80c1925f9

Analysis

max time kernel
241s
max time network
278s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 00:35

Target

d691bc59ccfe027b9ee01a7a2208af315eec9a69d5e6f0c5f07554a80c1925f9.dll
Size

6KB
MD5

ed7fbc86903440e0460ffe6fb07fb130
SHA1

a64ee16edb8330058832af9594420c24c45e0ff0
SHA256

d691bc59ccfe027b9ee01a7a2208af315eec9a69d5e6f0c5f07554a80c1925f9
SHA512

d73a40561e7dc1e99afe333ab7fb4149499ca08173692140a0adcfb1fcee4324ca740fbb72244f8a348e2b86c01afc0f09821ba2ba77e3993fc654d15d31ad92
SSDEEP

96:iT3Qu8uz0KXqs+drGlvHpfD/vCpnZWVl19qcG:izQhqbPXllD3yI

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4924 wrote to memory of 2096	4924	rundll32.exe	81
PID 4924 wrote to memory of 2096	4924	rundll32.exe	81
PID 4924 wrote to memory of 2096	4924	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d691bc59ccfe027b9ee01a7a2208af315eec9a69d5e6f0c5f07554a80c1925f9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d691bc59ccfe027b9ee01a7a2208af315eec9a69d5e6f0c5f07554a80c1925f9.dll,#1
  2⤵
  PID:2096