e219231c5a0029a63571415b4ff5b20e92b854aa983c0855ecf86c8ebff12308

Analysis

max time kernel
150s
max time network
189s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 02:48

Target

e219231c5a0029a63571415b4ff5b20e92b854aa983c0855ecf86c8ebff12308.dll
Size

9KB
MD5

bf9f98ae41b2423f6c7b83330373f46f
SHA1

4d0cddbd44afde09746f643577db8eee0807c7d7
SHA256

e219231c5a0029a63571415b4ff5b20e92b854aa983c0855ecf86c8ebff12308
SHA512

9dc7e5c8727bbc6d3535df56396a0a9b328575a58cd3d40319f6b8c35646d2acbec9787f5487b7feff7e5d3846530bf7fe95f449d0269c5059eb0567cd218cdf
SSDEEP

192:HRc81uT8wTQKABvvGljCqXmGiRvloYpXiY:xcWNv6LX4yY

Score

8^/10

Blocklisted process makes network request 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4660 wrote to memory of 4144	4660	rundll32.exe	79
PID 4660 wrote to memory of 4144	4660	rundll32.exe	79
PID 4660 wrote to memory of 4144	4660	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e219231c5a0029a63571415b4ff5b20e92b854aa983c0855ecf86c8ebff12308.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4660
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e219231c5a0029a63571415b4ff5b20e92b854aa983c0855ecf86c8ebff12308.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:4144