b7d0ebcb1358455cc097cced549eea6aaaa8403aa66d1f6f223e6b98caa35c38

Analysis

max time kernel
156s
max time network
189s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 07:59

Target

b7d0ebcb1358455cc097cced549eea6aaaa8403aa66d1f6f223e6b98caa35c38.dll
Size

45KB
MD5

591b01ee8d2a685582a33e00acd4c4d0
SHA1

97ee3cb13589ea1201b5a73b588f8074a77a3d17
SHA256

b7d0ebcb1358455cc097cced549eea6aaaa8403aa66d1f6f223e6b98caa35c38
SHA512

60f2ddc09a9848a53cdc478b43d87960c31aa69cd2b098c68f5d93600f18de355f3f501ff90e86fe85e8f3d9d0c0c61b10a817e7b0dd4585ff5a283c57a43dd2
SSDEEP

768:26cTcjNp0oMrTo/Wxf3IljbgVU4J8tFp8ICvIuS/YbhCTpA0DH70eFJxl13pEobD:23umoMtx+aFspKg/Ybuq0DbZfzz57lSW

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 2228	1684	rundll32.exe	79
PID 1684 wrote to memory of 2228	1684	rundll32.exe	79
PID 1684 wrote to memory of 2228	1684	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b7d0ebcb1358455cc097cced549eea6aaaa8403aa66d1f6f223e6b98caa35c38.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b7d0ebcb1358455cc097cced549eea6aaaa8403aa66d1f6f223e6b98caa35c38.dll,#1
  2⤵
  PID:2228