40220dc26902159df4419c59b8868a30e9f7b2cf436be15ca3d8b4b8ac56fc66

Analysis

max time kernel
133s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
15-05-2024 21:17

Target

40220dc26902159df4419c59b8868a30e9f7b2cf436be15ca3d8b4b8ac56fc66.dll
Size

81KB
MD5

c5a5275b4318b744d5b98b0f3b456956
SHA1

db097612091ef5d04b655fb1d06396e35a579377
SHA256

40220dc26902159df4419c59b8868a30e9f7b2cf436be15ca3d8b4b8ac56fc66
SHA512

d0b243be181e7a37818f13e24c1a6d4dbb34ac5195f37217f6248302f371e7029a135e486712db701bf634819eb7a3890ecb4194c7bedf267d8c540674feb112
SSDEEP

1536:VtByXv7uWGEqXZKXTadSp7Lxw9zzBPw+iASUSFOj8sWHcdF7zenq8WU:V4v4JKXTx71w0ArSsXF3enq8WU

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 4552	1196	rundll32.exe	85
PID 1196 wrote to memory of 4552	1196	rundll32.exe	85
PID 1196 wrote to memory of 4552	1196	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\40220dc26902159df4419c59b8868a30e9f7b2cf436be15ca3d8b4b8ac56fc66.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\40220dc26902159df4419c59b8868a30e9f7b2cf436be15ca3d8b4b8ac56fc66.dll,#1
  2⤵
  PID:4552