de29d5110765b8df71833c47141a548c1321f451380ce4199d8fcdfdc8df7ecb

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07/12/2022, 02:21

Target

de29d5110765b8df71833c47141a548c1321f451380ce4199d8fcdfdc8df7ecb.dll
Size

73KB
MD5

4c1ad71afab83dd96ea4241ac1490296
SHA1

4d71e0b5bf2f96162ecdd6dde0e9ba81b79a6184
SHA256

de29d5110765b8df71833c47141a548c1321f451380ce4199d8fcdfdc8df7ecb
SHA512

02664adee53bf41cec1ada7ca1f8081f07d63c98201f7fcc7ddc32101bd46853d15780d395c1ebd8947694acc12b339a402f6405d8270a843a292625def728e3
SSDEEP

1536:FPKlmRRInIdcwrwmjbwlGFpYER8t+Mr51OqVPFwbgfMPxn:Yl6ddrwSYKp7R21ZwE0

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 2228	1996	rundll32.exe	80
PID 1996 wrote to memory of 2228	1996	rundll32.exe	80
PID 1996 wrote to memory of 2228	1996	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\de29d5110765b8df71833c47141a548c1321f451380ce4199d8fcdfdc8df7ecb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\de29d5110765b8df71833c47141a548c1321f451380ce4199d8fcdfdc8df7ecb.dll,#1
  2⤵
  PID:2228