9bf15bb3a39d801efd9ce3b4484abcf71302596276e025a3179fa726363a4081

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 09:52

Target

9bf15bb3a39d801efd9ce3b4484abcf71302596276e025a3179fa726363a4081.dll
Size

54KB
MD5

ff7fbc20164137731aebbd6c429a41b7
SHA1

a44b08de35934bae77340db357ebc978d8e6be2b
SHA256

9bf15bb3a39d801efd9ce3b4484abcf71302596276e025a3179fa726363a4081
SHA512

c03fa7b2bf86ceebfa2e6292960a205bc59271001591f08e84d9332be6f4e2a428041d4a9a7654889d8e1efacc11ca8d9d2937dd714d8d40c2eba9eb9177b3c2
SSDEEP

768:4xFmDJua1lNAF3LjH+ERkS+iNWMMzXNV+MP0qozftJ0cF61in3jPT/BQR68C:4xFcH1W3/eXh17zdEMtozVJrF6En7P9

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4844 wrote to memory of 4760	4844	rundll32.exe	rundll32.exe
PID 4844 wrote to memory of 4760	4844	rundll32.exe	rundll32.exe
PID 4844 wrote to memory of 4760	4844	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9bf15bb3a39d801efd9ce3b4484abcf71302596276e025a3179fa726363a4081.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4844

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9bf15bb3a39d801efd9ce3b4484abcf71302596276e025a3179fa726363a4081.dll,#1
2⤵
PID:4760