cb932168e363063c0ee3c74441bdc800d8b137096b7d3bb8d6e881c68d826372

Analysis

max time kernel
150s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 05:45

Target

cb932168e363063c0ee3c74441bdc800d8b137096b7d3bb8d6e881c68d826372.dll
Size

4KB
MD5

9b2952f646df3b52e4de44936cdd0610
SHA1

b6b0ee750e11d1671f6524ff2501d178b0715cc4
SHA256

cb932168e363063c0ee3c74441bdc800d8b137096b7d3bb8d6e881c68d826372
SHA512

39a22983a9142d6648a55986902afbc639f0d7906a9e4b9b8f2025b1c0dc90e83ddb255bd0e94ed2ac2c974d1c19b51efe15388e743c5115f7bfede95dfaa496
SSDEEP

48:iMHGv8j2IcW89NYEArhWHR0MiiIsiI6lXVkqlcH2SuiS6o+mm9sla+FnzzY6n:PmkiIz8UZrQ0MhI/ITqly9so+FnvY6n

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4992 wrote to memory of 2044	4992	rundll32.exe	40
PID 4992 wrote to memory of 2044	4992	rundll32.exe	40
PID 4992 wrote to memory of 2044	4992	rundll32.exe	40

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cb932168e363063c0ee3c74441bdc800d8b137096b7d3bb8d6e881c68d826372.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4992
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cb932168e363063c0ee3c74441bdc800d8b137096b7d3bb8d6e881c68d826372.dll,#1
  2⤵
  PID:2044