9a4549fb0b50bbd3b20f331517cf3bc062928fea2c8e4891462b40cfecafd90e

Analysis

max time kernel
153s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2022, 17:59

Target

9a4549fb0b50bbd3b20f331517cf3bc062928fea2c8e4891462b40cfecafd90e.dll
Size

13KB
MD5

8281dc842317a473f93ca40918796837
SHA1

45b62c5ba6f7ee37c94da1f460def55e3bfb7395
SHA256

9a4549fb0b50bbd3b20f331517cf3bc062928fea2c8e4891462b40cfecafd90e
SHA512

f1ab6bfac345d947f6c617f8259910312758522f93c718d41a5c3996f9d4aafdecbbede8dd4eb6941d0215ced58236dcf89120a11924c996ceee9f34b6214070
SSDEEP

192:RRzVPeuZA9JvY6r7r0t+lgoVRferWPcG0oaBMTVDJYuxZ/:TzV2uZA9Tr35RfLPcBxBMTVD6ux

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1436 wrote to memory of 2016	1436	rundll32.exe	79
PID 1436 wrote to memory of 2016	1436	rundll32.exe	79
PID 1436 wrote to memory of 2016	1436	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9a4549fb0b50bbd3b20f331517cf3bc062928fea2c8e4891462b40cfecafd90e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1436
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9a4549fb0b50bbd3b20f331517cf3bc062928fea2c8e4891462b40cfecafd90e.dll,#1
  2⤵
  PID:2016