1983e6e7b92d16e8d99f5cc3b44d86ac18d1c0a0b1201437ee7d366ea3833196

Analysis

max time kernel
255s
max time network
278s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
28/11/2022, 03:46

Target

NotaFiscal.dll
Size

55KB
MD5

3cd66a5dd3cce9bbb4e5916b209625e7
SHA1

1362d32e31509244af8013579fcfdffda3f2be81
SHA256

0bb07fc6866fdddad87e9347799ad01abb02c75bea39000a56fe53d55914a23e
SHA512

6b488606f550ad599c96574d485cef3a5147896008218461f08547cc41ef82838f38135a155b86ff3257e979529ff58c7eeb5dc210015d0d2cd5a3d5378fa5f5
SSDEEP

768:WpWwVvQTrwankGlz/kykQfnxWa6LBMEV5VZR7JRQapXTqr1MeN+8FmWNfkS8WdN0:3fpkGFBxOLBMe7J3lTqrL+CNGgIXEa

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3116 wrote to memory of 448	3116	rundll32.exe	80
PID 3116 wrote to memory of 448	3116	rundll32.exe	80
PID 3116 wrote to memory of 448	3116	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NotaFiscal.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3116
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NotaFiscal.dll,#1
  2⤵
  PID:448