e2191b8ededf0ce2f316125f6d46ffb15b3f1d23c2a13c72604b0135fa575c37

Analysis

max time kernel
91s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 13:42

Target

e2191b8ededf0ce2f316125f6d46ffb15b3f1d23c2a13c72604b0135fa575c37.dll
Size

6KB
MD5

6fb236f5d8ec92d2aade82738b6138fd
SHA1

20a3424e3445b2f68275e659ebbf18f83a18c8f4
SHA256

e2191b8ededf0ce2f316125f6d46ffb15b3f1d23c2a13c72604b0135fa575c37
SHA512

9e675dd9563bd0e64fc618e25930196b66a183d92720b67e6ab0f21cc968811717f45158c530cf436463775652f15d2eb53039efd9a3cfb17a752268de64ea74
SSDEEP

96:Iadzcf8g1QmyZFPCJ+1nTDidIvb/8yOYtBuGKFaTj7yicApxppVSz:Iaw8eQBU+RXiart/tBqGJxH

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 4644	4656	rundll32.exe	78
PID 4656 wrote to memory of 4644	4656	rundll32.exe	78
PID 4656 wrote to memory of 4644	4656	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e2191b8ededf0ce2f316125f6d46ffb15b3f1d23c2a13c72604b0135fa575c37.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e2191b8ededf0ce2f316125f6d46ffb15b3f1d23c2a13c72604b0135fa575c37.dll,#1
  2⤵
  PID:4644

memory/4644-133-0x0000000000010000-0x0000000000012000-memory.dmp

Filesize
8KB

Download