ff6e7da82c0259372e45daaadb75de533eda002e3485af8fd40c9dec7d221905

Analysis

max time kernel
93s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 04:30

Target

ff6e7da82c0259372e45daaadb75de533eda002e3485af8fd40c9dec7d221905.dll
Size

5KB
MD5

b18f737494655d10a178143fc40d8650
SHA1

f3fc9092f29d71a2fcb9454c39e9d6e98523b989
SHA256

ff6e7da82c0259372e45daaadb75de533eda002e3485af8fd40c9dec7d221905
SHA512

7c8bfc78a80b89b99a958e5c1a535a4a105c409c4f3c33b005e8d91e4d4fefa6ec57cecd550ca49e02c816937b7c9c59171f7ecd995ee5335ad5ee1df923bd1e
SSDEEP

96:XprYDpKnI6wJ+Ls7guyHejyn/I9l0iai+2aF:XUcA+ggd+W/If0iIHF

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4364 wrote to memory of 4064	4364	rundll32.exe	78
PID 4364 wrote to memory of 4064	4364	rundll32.exe	78
PID 4364 wrote to memory of 4064	4364	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ff6e7da82c0259372e45daaadb75de533eda002e3485af8fd40c9dec7d221905.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4364
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ff6e7da82c0259372e45daaadb75de533eda002e3485af8fd40c9dec7d221905.dll,#1
  2⤵
  PID:4064