b95c4f354f85a335502b63cbea99686ab2129897d7a81fa096a8ad80c6424eb4

Analysis

max time kernel
163s
max time network
187s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
08/09/2022, 06:09 UTC

Target

Netviewer.resources.dll
Size

1.3MB
MD5

8ada1585850bf3258b297eb2a2536dee
SHA1

8a42932ba407fc4736cd1e87b04bd8fe1e007b0e
SHA256

3d365d01532dc432304cb3ad87b4b86764c9dd8882b0e84beecdb62d1bb35d7a
SHA512

f0271dfa1ca42caeff6e1a96ce025c69d9027b0a4d7f456da0c2c466a04fc6093d52b3f7be04c922e892014e4da35399f77e9086040cd3c07e57d63ec027ad1a
SSDEEP

24576:6JEFdNOvry0NyuSOnjygOCnh3yD7HZZnvEzOV+gWTk5JEFdNMVEFdN:SEFdNOv7omjyRyhiDNZnvEzOMnkbEFdZ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5068 wrote to memory of 4684	5068	rundll32.exe	81
PID 5068 wrote to memory of 4684	5068	rundll32.exe	81
PID 5068 wrote to memory of 4684	5068	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Netviewer.resources.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5068
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Netviewer.resources.dll,#1
  2⤵
  PID:4684

No results found