f7c65db4ee547949ab752c42400c5c2688af81c2c8dc9a3e2811f944147f0f85

Analysis

max time kernel
156s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2022 13:16

Target

f7c65db4ee547949ab752c42400c5c2688af81c2c8dc9a3e2811f944147f0f85.dll
Size

17KB
MD5

fb06a6a517d85238d5664e3b7f944036
SHA1

c984ae039fdacc351c92f149f29b03fab0bdd57c
SHA256

f7c65db4ee547949ab752c42400c5c2688af81c2c8dc9a3e2811f944147f0f85
SHA512

1109b8d1efd1ea8d4240630e0fb8fea04f47f4e9667ceee44a563d5a48fcc0f9ca4bbb7c6ee218a0db0059ec5e6cee569efca20a7d87e077eb42b1fe537bac8b
SSDEEP

384:vzKoGiMenI8Zw8UUTLRHX+uPbHVQ7LcjZFBwfAHM:rIdeZvLRHXsYjZcfe

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4292 wrote to memory of 4952	4292	rundll32.exe	80
PID 4292 wrote to memory of 4952	4292	rundll32.exe	80
PID 4292 wrote to memory of 4952	4292	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f7c65db4ee547949ab752c42400c5c2688af81c2c8dc9a3e2811f944147f0f85.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4292
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f7c65db4ee547949ab752c42400c5c2688af81c2c8dc9a3e2811f944147f0f85.dll,#1
  2⤵
  PID:4952