92dde1e37f8136c7216372e7a02a224d3f46075c3e93f12e818de248a0c020a6

Analysis

max time kernel
151s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 04:24

Target

92dde1e37f8136c7216372e7a02a224d3f46075c3e93f12e818de248a0c020a6.dll
Size

5KB
MD5

2f9bced7b019cd0bfcb9a9fa62f788d0
SHA1

31720571b5a2cd202d9a55fda486561b1aa692fb
SHA256

92dde1e37f8136c7216372e7a02a224d3f46075c3e93f12e818de248a0c020a6
SHA512

528494865c71fd65315e8e5002ec20804a625856f992d2d90aaa06e6f9ff92af9cd3d68ced5622d67a1938801f7cd9f1c687bfdf68304a4921d18c3e5211c6e7
SSDEEP

96:nEY2RrF1eqwi4rcccqccccqccccctcccqqqcqccq8cqc8qqcqccccqPqcc8qccX+:EHRh1eppX0

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4972 wrote to memory of 1760	4972	rundll32.exe	80
PID 4972 wrote to memory of 1760	4972	rundll32.exe	80
PID 4972 wrote to memory of 1760	4972	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\92dde1e37f8136c7216372e7a02a224d3f46075c3e93f12e818de248a0c020a6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\92dde1e37f8136c7216372e7a02a224d3f46075c3e93f12e818de248a0c020a6.dll,#1
  2⤵
  PID:1760