980e13c6d1c28fdcfccb44595216a4feb66a24bc9c5803e90b4a2a3f699f7405

Analysis

max time kernel
161s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28/10/2022, 18:09

Target

980e13c6d1c28fdcfccb44595216a4feb66a24bc9c5803e90b4a2a3f699f7405.dll
Size

52KB
MD5

0dd428d8b6c79abbff93e045e7da709a
SHA1

6169f710535ece9f6916d13e4827c74e9820a726
SHA256

980e13c6d1c28fdcfccb44595216a4feb66a24bc9c5803e90b4a2a3f699f7405
SHA512

c9796baa466f4f2fc555768f8a7bd4d3abfaf4217f55b51cf2a7bf23df89e5cb1059a2a13933ece6121f0b3520d83b8faf2b7572100d55df5d5adebc388a325e
SSDEEP

768:2788TBHR7oOj33NvwSFbyx9GGB8oYMW3Nu:2788TBHldxtbAcLoTW38

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 2248	1388	rundll32.exe	81
PID 1388 wrote to memory of 2248	1388	rundll32.exe	81
PID 1388 wrote to memory of 2248	1388	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\980e13c6d1c28fdcfccb44595216a4feb66a24bc9c5803e90b4a2a3f699f7405.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\980e13c6d1c28fdcfccb44595216a4feb66a24bc9c5803e90b4a2a3f699f7405.dll,#1
  2⤵
  PID:2248