a22b725839554d3ba897ce258b39df1100a34ecbab5cefd3ffa018019df94756

Analysis

max time kernel
190s
max time network
203s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2022 10:27

Target

a22b725839554d3ba897ce258b39df1100a34ecbab5cefd3ffa018019df94756.dll
Size

34KB
MD5

61d44f1d358fb18ae4a37ba1ddd67ba0
SHA1

a5cb51503e3d3260e1a8e58e182e417687c4c1c9
SHA256

a22b725839554d3ba897ce258b39df1100a34ecbab5cefd3ffa018019df94756
SHA512

451159ca1c579693b7f74b00a5651933236c1ec46fb51c2d8cc41a405e20b4e378c0d559dff5dbe3566e0a0f5ef383bb9f05fe311eb25aaf0434c26fd22fee77
SSDEEP

768:R7mRDL0cgngbMzSJOQc7S/DftqqhnP0RROPx:9mRD7gHzS0d7S/1pMRROp

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4676 wrote to memory of 1880	4676	rundll32.exe	82
PID 4676 wrote to memory of 1880	4676	rundll32.exe	82
PID 4676 wrote to memory of 1880	4676	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a22b725839554d3ba897ce258b39df1100a34ecbab5cefd3ffa018019df94756.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4676
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a22b725839554d3ba897ce258b39df1100a34ecbab5cefd3ffa018019df94756.dll,#1
  2⤵
  PID:1880