b28420cb70c2bb8d667bb34a49afb424c18677621f8fc23d7c4f82aaffc88f03

Analysis

max time kernel
146s
max time network
197s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 21:12

Target

b28420cb70c2bb8d667bb34a49afb424c18677621f8fc23d7c4f82aaffc88f03.dll
Size

40KB
MD5

e2f54444af1aa09c7d32663b2dcfd9f1
SHA1

8c04fe6cf635d911a918cf036009e3d91a6d20b6
SHA256

b28420cb70c2bb8d667bb34a49afb424c18677621f8fc23d7c4f82aaffc88f03
SHA512

42d2e770dd12052122c59f4bf8791d53ced457c4f94eb3a9eb6367f0b59f9657bda940b6eaf4956a03acce1f8290ce5b552ce7a3e7917e625b8542d5900e31f7
SSDEEP

768:j2iYh/i2OGzWYKaOm6+jXmnn6/JF36TdEgBBQARQkDgUHv:KrhOm36TdEgBBQARFv

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 480 wrote to memory of 4368	480	rundll32.exe	84
PID 480 wrote to memory of 4368	480	rundll32.exe	84
PID 480 wrote to memory of 4368	480	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b28420cb70c2bb8d667bb34a49afb424c18677621f8fc23d7c4f82aaffc88f03.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:480
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b28420cb70c2bb8d667bb34a49afb424c18677621f8fc23d7c4f82aaffc88f03.dll,#1
  2⤵
  PID:4368