996904b2e15657706b5a86092a7a09101f488db0c6723cdab5709b69856808cc

Analysis

max time kernel
167s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 04:44

Target

996904b2e15657706b5a86092a7a09101f488db0c6723cdab5709b69856808cc.dll
Size

28KB
MD5

56b90d59578b0f66ec6e1335cca4c8ab
SHA1

89868a1e7f63ee745c0abc1eb203b41ca7f379a3
SHA256

996904b2e15657706b5a86092a7a09101f488db0c6723cdab5709b69856808cc
SHA512

eb05d933c94745d91a362f0731a12556f404ac1de11850adb5d8e422424936c420b15b5a3ee546bd2b0205edde059dfe7a624334209c256a207012377572c1a0
SSDEEP

384:2+Q0Vcus+5DzDDKEm8iUtitMqH6xInWKikKp8/9wrAb2+VjoPAAeeoJ5:60VcH+B3GMN4CrAC+FoPxeeS

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 2180	1096	rundll32.exe	82
PID 1096 wrote to memory of 2180	1096	rundll32.exe	82
PID 1096 wrote to memory of 2180	1096	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\996904b2e15657706b5a86092a7a09101f488db0c6723cdab5709b69856808cc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\996904b2e15657706b5a86092a7a09101f488db0c6723cdab5709b69856808cc.dll,#1
  2⤵
  PID:2180