ddc531a648206e82c07e58a9cefd6300d0da95adc093a72a478188b30b503176

Analysis

max time kernel
147s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 13:59

Target

ddc531a648206e82c07e58a9cefd6300d0da95adc093a72a478188b30b503176.dll
Size

9KB
MD5

96fe68bb34b0d98df32b16140086d3ca
SHA1

2e038e9ed975504118485d88c9b9494745e3260e
SHA256

ddc531a648206e82c07e58a9cefd6300d0da95adc093a72a478188b30b503176
SHA512

73efa3de9a8432b0ff49bacbe678936497f28a1bf21e360bace5a9fb175f243670c377d0105a44a2241361ba0bc0fea861b05c144686b10d81edcfc2c58a0ca9
SSDEEP

96:6PfS00igjwD/inKzCd+gWwDf/Kc5l75MyLGFScf84Y2G3XA12RqyIC7tCEoZ:AfNxgjwriKzemcDefF7G3XucqyZoZ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1336 wrote to memory of 5096	1336	rundll32.exe	81
PID 1336 wrote to memory of 5096	1336	rundll32.exe	81
PID 1336 wrote to memory of 5096	1336	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ddc531a648206e82c07e58a9cefd6300d0da95adc093a72a478188b30b503176.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ddc531a648206e82c07e58a9cefd6300d0da95adc093a72a478188b30b503176.dll,#1
  2⤵
  PID:5096