44e688def88ccd68c7b3501b91fc5c8759a3f4cc30f30304e497ed960547201b

Analysis

max time kernel
176s
max time network
219s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 07:04

Target

44e688def88ccd68c7b3501b91fc5c8759a3f4cc30f30304e497ed960547201b.dll
Size

37KB
MD5

1fb7e3685da3963db4f5be6f1e9707b0
SHA1

e2cf406a76a300a22b9668949c68c80fbb5b8c65
SHA256

44e688def88ccd68c7b3501b91fc5c8759a3f4cc30f30304e497ed960547201b
SHA512

adb37621d63d145e660ed85ffd9c9818e8185b1d706e691c4c4656d8880f2dbcc37053c06b37c543f95a01b3a597c9c2de02dd44430c4abf94216797563f252c
SSDEEP

768:ItoC8iTBGo571TseLK97sXBj2rB8oZ7u4K:YqiTBG8pAP7ICqo9NK

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4760 wrote to memory of 4660	4760	rundll32.exe	79
PID 4760 wrote to memory of 4660	4760	rundll32.exe	79
PID 4760 wrote to memory of 4660	4760	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\44e688def88ccd68c7b3501b91fc5c8759a3f4cc30f30304e497ed960547201b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4760
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\44e688def88ccd68c7b3501b91fc5c8759a3f4cc30f30304e497ed960547201b.dll,#1
  2⤵
  PID:4660