b7f86182e0c4d1a124d2a84522505090e9c2c9d4cf2727dab0e03e74313a6465

Analysis

max time kernel
161s
max time network
199s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 20:53

Target

b7f86182e0c4d1a124d2a84522505090e9c2c9d4cf2727dab0e03e74313a6465.dll
Size

14KB
MD5

1b7c512782cf44c750b898feb83ca901
SHA1

182f6f145b0641df8a171289e00c1d164cfda452
SHA256

b7f86182e0c4d1a124d2a84522505090e9c2c9d4cf2727dab0e03e74313a6465
SHA512

01da5774c8d0d7668385cae4994f69f4c61ce1f5f891f7472295df2d11ff9dbc3d954a8e32a88b4e9d7bc232413b8690c32c4e084dd72417ca6588be7f78130a
SSDEEP

384:h3Ji7IgwFV9kUKDKuBEcWWzrc6KloE20SPvjZ:XmfCV9j6fByiKt0F

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 1392	2348	rundll32.exe	78
PID 2348 wrote to memory of 1392	2348	rundll32.exe	78
PID 2348 wrote to memory of 1392	2348	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b7f86182e0c4d1a124d2a84522505090e9c2c9d4cf2727dab0e03e74313a6465.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b7f86182e0c4d1a124d2a84522505090e9c2c9d4cf2727dab0e03e74313a6465.dll,#1
  2⤵
  PID:1392