9fd7ac2217d6a9d38ee8a9e4b1819f6e5d05580092728ef3cfa3a0ea0b6618af

Analysis

max time kernel
34s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 19:49

Target

9fd7ac2217d6a9d38ee8a9e4b1819f6e5d05580092728ef3cfa3a0ea0b6618af.dll
Size

240KB
MD5

a06b8c9963488a5564072425f3c83d65
SHA1

4275a6e9876a1ee9a4d19fdaf19a818bdac6b691
SHA256

9fd7ac2217d6a9d38ee8a9e4b1819f6e5d05580092728ef3cfa3a0ea0b6618af
SHA512

97c3fab1838804387824b04e0a3acde0649cdd8c06e33ecefa2f39985ce4c60a610d223a2dc60242ea51e16b6d3df62688d38aef5f94eaaa5fead6c7f876658d
SSDEEP

6144:Xl1c2mN94/QzVrOi9Ql1c2mN94/QzVrOi9h:Xl1c2mY/Isrl1c2mY/Is6

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5080 wrote to memory of 4880	5080	rundll32.exe	81
PID 5080 wrote to memory of 4880	5080	rundll32.exe	81
PID 5080 wrote to memory of 4880	5080	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9fd7ac2217d6a9d38ee8a9e4b1819f6e5d05580092728ef3cfa3a0ea0b6618af.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5080
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9fd7ac2217d6a9d38ee8a9e4b1819f6e5d05580092728ef3cfa3a0ea0b6618af.dll,#1
  2⤵
  PID:4880