9eedec7a4c14e97094097b333883a2c27de961be541a63bcd1a080cb702ae40b

Analysis

max time kernel
107s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
08/09/2022, 05:32

Target

Netviewer.resources.dll
Size

1.3MB
MD5

8ada1585850bf3258b297eb2a2536dee
SHA1

8a42932ba407fc4736cd1e87b04bd8fe1e007b0e
SHA256

3d365d01532dc432304cb3ad87b4b86764c9dd8882b0e84beecdb62d1bb35d7a
SHA512

f0271dfa1ca42caeff6e1a96ce025c69d9027b0a4d7f456da0c2c466a04fc6093d52b3f7be04c922e892014e4da35399f77e9086040cd3c07e57d63ec027ad1a
SSDEEP

24576:6JEFdNOvry0NyuSOnjygOCnh3yD7HZZnvEzOV+gWTk5JEFdNMVEFdN:SEFdNOv7omjyRyhiDNZnvEzOMnkbEFdZ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1256 wrote to memory of 1936	1256	rundll32.exe	82
PID 1256 wrote to memory of 1936	1256	rundll32.exe	82
PID 1256 wrote to memory of 1936	1256	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Netviewer.resources.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1256
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Netviewer.resources.dll,#1
  2⤵
  PID:1936