93fd0046525c2e1be8b73a2267bdf941396acd4e9870be7caf93c5c32e76a7ff

Analysis

max time kernel
142s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2022, 09:39

Target

93fd0046525c2e1be8b73a2267bdf941396acd4e9870be7caf93c5c32e76a7ff.dll
Size

49KB
MD5

6ee48078ad4c5285a331a8fd481e3e1f
SHA1

1599570f825b6f09368f34ac966cd4e1044e6cac
SHA256

93fd0046525c2e1be8b73a2267bdf941396acd4e9870be7caf93c5c32e76a7ff
SHA512

42fe72fd2a51dd7ee4970cb6c9d26ef5e713734b3a76c7c09bac1ff39d823e92a45694e89b3281a9b38748ace05b2a69b3219dd52ab0a2d8c4dac24efbb45512
SSDEEP

1536:mPO6KEVbsVP0g7zyMmC6fg6JuUVpn2LE7eFP+QE4:cMEVbsVcmyraUb2Q7elh

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4904 wrote to memory of 4372	4904	rundll32.exe	84
PID 4904 wrote to memory of 4372	4904	rundll32.exe	84
PID 4904 wrote to memory of 4372	4904	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\93fd0046525c2e1be8b73a2267bdf941396acd4e9870be7caf93c5c32e76a7ff.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\93fd0046525c2e1be8b73a2267bdf941396acd4e9870be7caf93c5c32e76a7ff.dll,#1
  2⤵
  PID:4372