730ec847a5cc58810c38b8206f8d6d66c9f8321f3bca41f8937e5559eec99dcb

Analysis

max time kernel
90s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 01:24

Target
730ec847a5cc58810c38b8206f8d6d66c9f8321f3bca41f8937e5559eec99dcb.dll
Size 4KB
Sample221206-bsfqfsee86
SHA256 730ec847a5cc58810c38b8206f8d6d66c9f8321f3bca41f8937e5559eec99dcb
MD5 b4971a7e8fa69704721a50ca91f86310
SHA1 7f389c04a07348f5b81d653b1b60184e11483d03
SHA512 22afc45ee300ad205a7f9dc584263c52606065778c843029be2725dfc5656f8f3fbb43f1291a32388c84658b97b5b184b3300ff42cf991ee2e8b090296876c95
SSDEEP 24:eNGS7EiUT73Ce2v/kPVCRVtc44MxFOKMtc8v874IVHLeM8sQgJ7HZjhta3IFuMlm:a7Q2voyT+Bt5a958sQy7HZj/J2TT
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5028 wrote to memory of 1336	5028	rundll32.exe	81
PID 5028 wrote to memory of 1336	5028	rundll32.exe	81
PID 5028 wrote to memory of 1336	5028	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\730ec847a5cc58810c38b8206f8d6d66c9f8321f3bca41f8937e5559eec99dcb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\730ec847a5cc58810c38b8206f8d6d66c9f8321f3bca41f8937e5559eec99dcb.dll,#1
  2⤵
  PID:1336