344241b8c14d4eba9be3d8d9bb2eb8f93420ec649aba20a63171cc542678a620

Analysis

max time kernel
141s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2022 01:16

Target

344241b8c14d4eba9be3d8d9bb2eb8f93420ec649aba20a63171cc542678a620.dll
Size

53KB
MD5

f7fd428fac02a8e8ba86857e168c6ad8
SHA1

adbfb1217155bd088065ef7817d365aa8303c327
SHA256

344241b8c14d4eba9be3d8d9bb2eb8f93420ec649aba20a63171cc542678a620
SHA512

9724ab1dea8fd984e25b0cc6f842717fe080bfd858170de545cf65eeb7e3bfd75eb86ad4c4b2b0a2568cfc742e8d7404b90dc491e17b39e97982eb5d53e0b036
SSDEEP

768:Gx4m7JNSll3dTG+3rZ0yb4wRgOGsyRKuZFQ26ofg5F1gFLC4+y+uA1:Bm1NGJVGWZ94w4FKu3n45t4+xuA1

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3100 wrote to memory of 3212	3100	rundll32.exe	82
PID 3100 wrote to memory of 3212	3100	rundll32.exe	82
PID 3100 wrote to memory of 3212	3100	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\344241b8c14d4eba9be3d8d9bb2eb8f93420ec649aba20a63171cc542678a620.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3100
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\344241b8c14d4eba9be3d8d9bb2eb8f93420ec649aba20a63171cc542678a620.dll,#1
  2⤵
  PID:3212