fbb00dd0f8b7252aefe43d6dc16d4433adb80b4f36dcc0173366161daf1e9931

Analysis

max time kernel
188s
max time network
214s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 04:30

Target

fbb00dd0f8b7252aefe43d6dc16d4433adb80b4f36dcc0173366161daf1e9931.dll
Size

6KB
MD5

dd4dc4e6df3eb034926bbbd67b4d9220
SHA1

9d9a81ee9314b5913e25a441a4dfecc81e8e6776
SHA256

fbb00dd0f8b7252aefe43d6dc16d4433adb80b4f36dcc0173366161daf1e9931
SHA512

61eb3e089f2f8bcc7cf76506ab6adb8eda0a8e768f962f365fe0a5036ad279af1387fbf10f5d44f11da3d243e70504e239da24fec05631f9bc94a5aac05887d1
SSDEEP

96:hyZxm/jmjhjvj3jcZGV4OGaJnaCohwVdB9ojJHdXGM5rXP5:2M/SdjbgYlGaJnnohwVdByF5GorXP5

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1396 wrote to memory of 1092	1396	rundll32.exe	81
PID 1396 wrote to memory of 1092	1396	rundll32.exe	81
PID 1396 wrote to memory of 1092	1396	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fbb00dd0f8b7252aefe43d6dc16d4433adb80b4f36dcc0173366161daf1e9931.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1396
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fbb00dd0f8b7252aefe43d6dc16d4433adb80b4f36dcc0173366161daf1e9931.dll,#1
  2⤵
  PID:1092