33fd3768c3159ccbf529c1d58b686adaf6ed09ea7e66128114e5d3fa125b37d9

Analysis

max time kernel
1s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2023, 20:17

Target

33fd3768c3159ccbf529c1d58b686adaf6ed09ea7e66128114e5d3fa125b37d9.dll
Size

204KB
MD5

bc8404939981d185e67a68294a4386dd
SHA1

cc9f670127d57a52d2431484794aa961481abcb2
SHA256

33fd3768c3159ccbf529c1d58b686adaf6ed09ea7e66128114e5d3fa125b37d9
SHA512

f61a171a0a05c581d0f459c6479d8a11a3910ef9e73c58b04631a650114b0dbdb502d022eef4f779985994ab84c1bc3dcddc9d6fb0a6c23cacd3750c82b2359f
SSDEEP

3072:QMJD77bKI6gJjZEy/+IbBjFgqEVrh36rSQj6Apu++rnk45cfRrw5KoUThElu:QM1KI6g+kj+XQj6ku5k45otNEl

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4220 wrote to memory of 4064	4220	rundll32.exe	78
PID 4220 wrote to memory of 4064	4220	rundll32.exe	78
PID 4220 wrote to memory of 4064	4220	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\33fd3768c3159ccbf529c1d58b686adaf6ed09ea7e66128114e5d3fa125b37d9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4220
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\33fd3768c3159ccbf529c1d58b686adaf6ed09ea7e66128114e5d3fa125b37d9.dll,#1
  2⤵
  PID:4064