c74a117ffcad24d86c41656ede714dc38d7b81a4b3a5b302da8aa3858b2bf266

Analysis

max time kernel
278s
max time network
435s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 01:41

Target

c74a117ffcad24d86c41656ede714dc38d7b81a4b3a5b302da8aa3858b2bf266.dll
Size

105KB
MD5

21c028bf885a8d891ce6d746353420c8
SHA1

658b795e2320eb4a79c32047185541b6e069d69a
SHA256

c74a117ffcad24d86c41656ede714dc38d7b81a4b3a5b302da8aa3858b2bf266
SHA512

ee3a49f9d31462756e37638dff8ba1b7257960c8fd3916ace6d94b23a25df9571d9f45c638919e1a67375f164aa5b2cb0648459c3088b8c390f676a96c19bcc1
SSDEEP

1536:RtD1PWdDGVc2iLfiFaLftrFuZjizwgbibv:RHWdGVxibiFahBQizwuc

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3552 wrote to memory of 4220	3552	rundll32.exe	83
PID 3552 wrote to memory of 4220	3552	rundll32.exe	83
PID 3552 wrote to memory of 4220	3552	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c74a117ffcad24d86c41656ede714dc38d7b81a4b3a5b302da8aa3858b2bf266.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3552
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c74a117ffcad24d86c41656ede714dc38d7b81a4b3a5b302da8aa3858b2bf266.dll,#1
  2⤵
  PID:4220