f942230367ce959f5dcc4fc4d60fe92431bfda1f92e26e74a9e18b90d58225ba

Analysis

max time kernel
143s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
21-08-2023 15:57

Target

f942230367ce959f5dcc4fc4d60fe92431bfda1f92e26e74a9e18b90d58225ba.dll
Size

215KB
MD5

de017f327ee18d5c50124a3b20602964
SHA1

113079802abd226a3c43a8e085dd113be822282e
SHA256

f942230367ce959f5dcc4fc4d60fe92431bfda1f92e26e74a9e18b90d58225ba
SHA512

d3e2409ce9e86a4ba381a9c8e8c3f851cf4b67192c3344b1bd26a029f4b0666d5ef6947c9ebe8b13383742f00644eb68a55c812cd7943daddd7575e6ad5771bb
SSDEEP

3072:3i7q4m2yQmbxtmbxMJBKfTchkgOLqXFrr0XMMuH:S7q4WmdfTPYiXMM

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 544 wrote to memory of 1340	544	rundll32.exe	81
PID 544 wrote to memory of 1340	544	rundll32.exe	81
PID 544 wrote to memory of 1340	544	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f942230367ce959f5dcc4fc4d60fe92431bfda1f92e26e74a9e18b90d58225ba.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:544
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f942230367ce959f5dcc4fc4d60fe92431bfda1f92e26e74a9e18b90d58225ba.dll,#1
  2⤵
  PID:1340