caa73370b5bd4107268b1718894306cac23c6556bcc48f9844744f2602bf88ca

Analysis

max time kernel
133s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
21-12-2022 18:15

Target

caa73370b5bd4107268b1718894306cac23c6556bcc48f9844744f2602bf88ca.dll
Size

860KB
MD5

36bbcf6ccca4780d6420c74af426be1e
SHA1

f749f4de5698ec9c73b7d4a9acf1fac5d8dd4a9c
SHA256

caa73370b5bd4107268b1718894306cac23c6556bcc48f9844744f2602bf88ca
SHA512

ebdc66d2ba8e23624efc54d513d4046de860a1b768ba580dbc1cb82835bb9a48d478ca316309bf10d2f5bd20be94f9650309d44197e2123dd2d3277980fa0590
SSDEEP

12288:OOM7U1crfk4xv70MYfxKp2iChVwDNVPXL5MTScGZAN7PksTCdpeNRXSvfFbwqsH6:grVTf2xZiuODH/+w4ksTYerXSvtwXa

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4816 wrote to memory of 5012	4816	rundll32.exe	81
PID 4816 wrote to memory of 5012	4816	rundll32.exe	81
PID 4816 wrote to memory of 5012	4816	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\caa73370b5bd4107268b1718894306cac23c6556bcc48f9844744f2602bf88ca.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4816
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\caa73370b5bd4107268b1718894306cac23c6556bcc48f9844744f2602bf88ca.dll,#1
  2⤵
  PID:5012