59494c2ec23e1f3d1aeb093995f34cccafd9fea41ffe080b7010aa31c6bd4248

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 21:54

Target

59494c2ec23e1f3d1aeb093995f34cccafd9fea41ffe080b7010aa31c6bd4248.dll
Size

32KB
MD5

a86d521bb822db0aa5e716479b92d320
SHA1

a651ad91606af2b13af3b39f1fe546a5db70c146
SHA256

59494c2ec23e1f3d1aeb093995f34cccafd9fea41ffe080b7010aa31c6bd4248
SHA512

125703f377d70c4dfcbfbe4d8db10055fbcd69d0f7d06ffdfd98c03e1b8ebb06a502eda0f1e06f7579d527a5fef621da69217b7d10ab4d36d145ea671bc2a48f
SSDEEP

768:8Ih6p/HSZlfvKppbJ17vyfrxOVOGKLRqMjGf:p6pNppj7afryERqMjGf

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 4232	2236	rundll32.exe	76
PID 2236 wrote to memory of 4232	2236	rundll32.exe	76
PID 2236 wrote to memory of 4232	2236	rundll32.exe	76

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\59494c2ec23e1f3d1aeb093995f34cccafd9fea41ffe080b7010aa31c6bd4248.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\59494c2ec23e1f3d1aeb093995f34cccafd9fea41ffe080b7010aa31c6bd4248.dll,#1
  2⤵
  PID:4232