bda4fd38e9bb9663a933886b5764dc9f27b47cc11540a9d5c0f7a319d5580379

Analysis

max time kernel
61s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 13:49

Target
bda4fd38e9bb9663a933886b5764dc9f27b47cc11540a9d5c0f7a319d5580379.dll
Size 424KB
Sample221206-q4pvtsda89
SHA256 bda4fd38e9bb9663a933886b5764dc9f27b47cc11540a9d5c0f7a319d5580379
MD5 6cceea8f599a581f2b0c9e16ef490e55
SHA1 61dac45cecb92e03f2037112750025235f3e3619
SHA512 cd58b8e404e36b64d102acd62e0d2a543bdfd6ac2c825b391920b9e0e6bcd66cb334e667545e0e545a8a6940d74d0faa9e19aceb85b6b91013ce3d76f30a01a6
SSDEEP 12288:GQqyywSpGDH4+Ol5mWVvHmN6w1zAAZ9B:unmDY+Ol5mWBHmNX1P
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4816 wrote to memory of 3704	4816	rundll32.exe	82
PID 4816 wrote to memory of 3704	4816	rundll32.exe	82
PID 4816 wrote to memory of 3704	4816	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bda4fd38e9bb9663a933886b5764dc9f27b47cc11540a9d5c0f7a319d5580379.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4816
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bda4fd38e9bb9663a933886b5764dc9f27b47cc11540a9d5c0f7a319d5580379.dll,#1
  2⤵
  PID:3704