dd00cb395495de3e2149cd3ab26fb0d41ae752b565736a4856a17e48a6a11842

Analysis

max time kernel
187s
max time network
260s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 00:56

Target
dd00cb395495de3e2149cd3ab26fb0d41ae752b565736a4856a17e48a6a11842.dll
Size 5KB
Sample221204-bawc7acf73
SHA256 dd00cb395495de3e2149cd3ab26fb0d41ae752b565736a4856a17e48a6a11842
MD5 8debaa0a850ba382a48c603b298707d0
SHA1 a4924239ddfaf1187e7cc70ef5d6ba2b92c1d756
SHA512 affa1578463a741627b2d8a752ec3395305f14ca019e4111213d1ff76686d0162b0f51e14d8e17d850015499e1184a4998461c06da7ec847c0985ea94de9d688
SSDEEP 48:SsGp63gAST0cMLlD7prUlG9NzgrcM2E6sJ7fbDkxNsXOeT41A4S1cr+Sjw+M4dA:VGEETrMLH5TEfJDbDdOCV4lrfjwrAA
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3720 wrote to memory of 3788	3720	rundll32.exe	80
PID 3720 wrote to memory of 3788	3720	rundll32.exe	80
PID 3720 wrote to memory of 3788	3720	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd00cb395495de3e2149cd3ab26fb0d41ae752b565736a4856a17e48a6a11842.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3720
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd00cb395495de3e2149cd3ab26fb0d41ae752b565736a4856a17e48a6a11842.dll,#1
  2⤵
  PID:3788