c2b2b7a96d8dcc562c321db3a0e9b034e618cbf7d20b9d4434364b62ed634231

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 00:35

Target
c2b2b7a96d8dcc562c321db3a0e9b034e618cbf7d20b9d4434364b62ed634231.dll
Size 4KB
Sample221204-axla3afa81
SHA256 c2b2b7a96d8dcc562c321db3a0e9b034e618cbf7d20b9d4434364b62ed634231
MD5 f4c0f51773a019499709c19aff4addc0
SHA1 a1a247c475606ff2ceac53572f1c1f06c2ee3905
SHA512 519194c7f88ffe864d0917f9894f7455d3cbdec693590c4fb7dedb0161ea8407db89779c2dd0e93c6c5b22524af33539668ca065a8cc1ca5cf697a3a7d32678c
SSDEEP 48:a5zjMTGcITBVQVE1lcyZTk1L7Qd06o8DesOBfzvTkelrzCoQJ2:iT3Qu8aTk1L7o06oIt4ZrOoQM
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1268 wrote to memory of 4856	1268	rundll32.exe	81
PID 1268 wrote to memory of 4856	1268	rundll32.exe	81
PID 1268 wrote to memory of 4856	1268	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c2b2b7a96d8dcc562c321db3a0e9b034e618cbf7d20b9d4434364b62ed634231.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c2b2b7a96d8dcc562c321db3a0e9b034e618cbf7d20b9d4434364b62ed634231.dll,#1
  2⤵
  PID:4856