db9e20a72d67e545434b968df180db21a653819d1063c314b969d6405763c542

Analysis

max time kernel
233s
max time network
308s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24/11/2022, 00:49

Target

db9e20a72d67e545434b968df180db21a653819d1063c314b969d6405763c542.dll
Size

31KB
MD5

32e98b5fc1457f979165ea379f1f3100
SHA1

d06b7547a9a02616caa40c86351eedf85bf71c29
SHA256

db9e20a72d67e545434b968df180db21a653819d1063c314b969d6405763c542
SHA512

63eac034834d65fec45e63b60a5a0abdfbc558afa601fdcd020f9d1718f8ce29c39d89aa7c6960b923180be26f45faeabec83621703016d7cbab4cbda59f2c26
SSDEEP

192:VRRQmkmHk+NIlKa1O0xMtMNwbHEcvTGwdRODWZqL2Z:VRPkGkDKWO0YJjEAGmOWEc

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 928 wrote to memory of 1280	928	rundll32.exe	81
PID 928 wrote to memory of 1280	928	rundll32.exe	81
PID 928 wrote to memory of 1280	928	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\db9e20a72d67e545434b968df180db21a653819d1063c314b969d6405763c542.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:928
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\db9e20a72d67e545434b968df180db21a653819d1063c314b969d6405763c542.dll,#1
  2⤵
  PID:1280