37b4262f798ba492ce027d5ba250d38db744727634f4aed3a759b44a3bc02527

Analysis

max time kernel
148s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 11:35 UTC

Target

37b4262f798ba492ce027d5ba250d38db744727634f4aed3a759b44a3bc02527.dll
Size

6KB
MD5

ae289fc5b941bf2db91a0acdf1d3b320
SHA1

7df6d6d18e5bdd4b77c7c02b63dee21f9c510027
SHA256

37b4262f798ba492ce027d5ba250d38db744727634f4aed3a759b44a3bc02527
SHA512

097fe1d3a158e1a244a751628adf3469202b96606b4d37c0bf2a6c43bc2a48397639b6f2ebf938aae7fbfd5ff4d02e37a08d2654da9cf7e68c6ef6f156bd6d67
SSDEEP

192:unSR6bgYEK32gb/wVLfx8JkuDL24i/P2eiR1hRwCZ8hXRl5D:uZEh

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4856 wrote to memory of 552	4856	rundll32.exe	79
PID 4856 wrote to memory of 552	4856	rundll32.exe	79
PID 4856 wrote to memory of 552	4856	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\37b4262f798ba492ce027d5ba250d38db744727634f4aed3a759b44a3bc02527.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\37b4262f798ba492ce027d5ba250d38db744727634f4aed3a759b44a3bc02527.dll,#1
  2⤵
  PID:552