c9fd3e68ad861428ba81917a6ca125d0bd8da66b7594e6659c5941a55732edf3

Analysis

max time kernel
94s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2022, 07:39

Target

c9fd3e68ad861428ba81917a6ca125d0bd8da66b7594e6659c5941a55732edf3.dll
Size

114KB
MD5

5d4a340bf3e772629f118080321d7994
SHA1

3c97443aa3db67de9332b42fd700d8073dee0bd8
SHA256

c9fd3e68ad861428ba81917a6ca125d0bd8da66b7594e6659c5941a55732edf3
SHA512

975e2107c4145e79495b6db1f3acf87049169c2665b30a391d347fae5bf79423f99527fd18c4973d136e08ad5971b33dd691825dcc9fffa997f5900b43373063
SSDEEP

3072:TpoZP8ijIfaBfLJj1xtajFIMyJ3vX5XrmORJ0R:TpHiua/WFIz/X57mORq

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4868 wrote to memory of 4872	4868	rundll32.exe	82
PID 4868 wrote to memory of 4872	4868	rundll32.exe	82
PID 4868 wrote to memory of 4872	4868	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c9fd3e68ad861428ba81917a6ca125d0bd8da66b7594e6659c5941a55732edf3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4868
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c9fd3e68ad861428ba81917a6ca125d0bd8da66b7594e6659c5941a55732edf3.dll,#1
  2⤵
  PID:4872

memory/4872-133-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download