d12d99b16fc4c95137c1923105062920702e25b57b60c5baa16b1f3ba35c88b9

Analysis

max time kernel
192s
max time network
208s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 21:12

Target

d12d99b16fc4c95137c1923105062920702e25b57b60c5baa16b1f3ba35c88b9.dll
Size

44KB
MD5

e28373fec5fb37bdb5f9b3eafb5de662
SHA1

abff906ff4145cb650225841cb6ab58d7e04c833
SHA256

d12d99b16fc4c95137c1923105062920702e25b57b60c5baa16b1f3ba35c88b9
SHA512

464187ada46f02f4e859ca590f118366c2586bbb01045b7302dbbe8d9f4fd1bb251c2efa66377120d5955186efc0164805a72980a31bb2804315ae4d8375fc2a
SSDEEP

768:cVV7m2JvWSRAHYKoGyYQQNBeJXlK51GBM2hBBQARQkeElA/:2VXRAnGBM2hBBQAR9C

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 2900	4768	rundll32.exe	81
PID 4768 wrote to memory of 2900	4768	rundll32.exe	81
PID 4768 wrote to memory of 2900	4768	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d12d99b16fc4c95137c1923105062920702e25b57b60c5baa16b1f3ba35c88b9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d12d99b16fc4c95137c1923105062920702e25b57b60c5baa16b1f3ba35c88b9.dll,#1
  2⤵
  PID:2900