d358053cb226efeeb4ba2c811cf9e4851706ceb9e7bd517964ae61487b1c66be

Analysis

max time kernel
162s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 07:00

Target

d358053cb226efeeb4ba2c811cf9e4851706ceb9e7bd517964ae61487b1c66be.dll
Size

8KB
MD5

ac2b9d88b5148172e35c50d98131072b
SHA1

dcc392c8b545190d45bbff6544b629bf4ec0328a
SHA256

d358053cb226efeeb4ba2c811cf9e4851706ceb9e7bd517964ae61487b1c66be
SHA512

9dd9d63811501d31efd58576e9593c0aa875e871c8f4525a570ecbc1b25ddb89866a10bb36f2c2afb5db07c037b50e7b1a91fa5f4ac7d777c854dd4d8204d65a
SSDEEP

96:H8JHxN1Sg1iO4tnx2J7Ku+8oJjt12CJccL5ywHwbvW94/B:cJRNIIiJnxUK38y1+WkvW6/B

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 8 wrote to memory of 4980	8	rundll32.exe	82
PID 8 wrote to memory of 4980	8	rundll32.exe	82
PID 8 wrote to memory of 4980	8	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d358053cb226efeeb4ba2c811cf9e4851706ceb9e7bd517964ae61487b1c66be.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:8
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d358053cb226efeeb4ba2c811cf9e4851706ceb9e7bd517964ae61487b1c66be.dll,#1
  2⤵
  PID:4980