ffed24a6206746313d22b43c7b554b9cefcb41b53514e2a52c0374f38552376f

Analysis

max time kernel
91s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
30-10-2022 20:42

Target

ffed24a6206746313d22b43c7b554b9cefcb41b53514e2a52c0374f38552376f.dll
Size

5KB
MD5

8201990a3b9fc92b644f5e8cc477c64a
SHA1

d0cf06c27a379f6a3653af4b350b3325636a41d8
SHA256

ffed24a6206746313d22b43c7b554b9cefcb41b53514e2a52c0374f38552376f
SHA512

a215dce5fc68f6a4402466598c3a189d4975fabdc4a1472578baf4332b88db04d37b96343d5f8503782c24692d00b911c4fdcf6ec07f7b70081ac8e4b6d5a6fe
SSDEEP

48:a7Q2voyT+Bt5a92tJt9ak5NQKCajM/hD9Jj3Jxz3ztunV+EGk:qT+ZKCDRLCajQvJjXtofZ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 1380	1724	rundll32.exe	82
PID 1724 wrote to memory of 1380	1724	rundll32.exe	82
PID 1724 wrote to memory of 1380	1724	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffed24a6206746313d22b43c7b554b9cefcb41b53514e2a52c0374f38552376f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffed24a6206746313d22b43c7b554b9cefcb41b53514e2a52c0374f38552376f.dll,#1
  2⤵
  PID:1380