bda51c20f960f2da3e7055a224194c2ff443cc5abcd8c98b96e98f6aac95cc2e

Analysis

max time kernel
91s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2023 10:42

Target

450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105.dll
Size

37KB
MD5

67965a5957a61867d661f05ae1f4773e
SHA1

f14c0a4f154dc685bb7c65b2d804a02a0fb2360d
SHA256

450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105
SHA512

c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b
SSDEEP

768:kyNq+QWR4gxSUzF08/zFlKcLdQxNld36fJPHw5g4wT1C:jNq+Qw0+JLAqf9Hw5C1C

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4816 wrote to memory of 740	4816	rundll32.exe	79
PID 4816 wrote to memory of 740	4816	rundll32.exe	79
PID 4816 wrote to memory of 740	4816	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4816
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105.dll,#1
  2⤵
  PID:740