9906bdb1da39bc67066cf56ccb4d3a1ed19af36f22d11efd831ecd2d57437050

Analysis

max time kernel
149s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 14:05

Target

9906bdb1da39bc67066cf56ccb4d3a1ed19af36f22d11efd831ecd2d57437050.dll
Size

30KB
MD5

962e33d32797cfb6681ca349f3b09b2e
SHA1

a22e677cb54b10ff5e686e319d3bf7dae6a783d1
SHA256

9906bdb1da39bc67066cf56ccb4d3a1ed19af36f22d11efd831ecd2d57437050
SHA512

64509e1b63b49596d09da839dc694b5dbcf3aa0316df13e901560f0a058667b9dad57dc579d90b6f00d9e9d56baf335d744f0018033f9456573261d4d2554a5e
SSDEEP

384:IDJs5yqusFWtRCcH4DcjZGsXVVbRKdPg0uQEuwb5rKgKMKJCmkLv3jPH/OfGlSTB:IQuss8efsub83LJC33jOfOSPVK

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 4588	2132	rundll32.exe	84
PID 2132 wrote to memory of 4588	2132	rundll32.exe	84
PID 2132 wrote to memory of 4588	2132	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9906bdb1da39bc67066cf56ccb4d3a1ed19af36f22d11efd831ecd2d57437050.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9906bdb1da39bc67066cf56ccb4d3a1ed19af36f22d11efd831ecd2d57437050.dll,#1
  2⤵
  PID:4588

memory/4588-133-0x0000000010000000-0x000000001000B000-memory.dmp

Filesize
44KB

Download