9544fc60ab46d3b9d50749767e186d8f1cc4b572a6a6e2a01a38a137b24301da

Analysis

max time kernel
140s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 05:05

Target

9544fc60ab46d3b9d50749767e186d8f1cc4b572a6a6e2a01a38a137b24301da.dll
Size

204KB
MD5

5afe0f21645934d8057a0188fc79a9ad
SHA1

98190ac572e506d7734040e9b03df09b32a3ec1a
SHA256

9544fc60ab46d3b9d50749767e186d8f1cc4b572a6a6e2a01a38a137b24301da
SHA512

d8ac9974eefde6ebbf7b9e0c448b2497af2d87a6f7080af8ade43d9dab7fb41d2584e5f8fcbda68087660ead9fb958657d4af1b4f29a5c14f6832696fee737e7
SSDEEP

3072:njtd9nLA46qgvD+368ThDZQnUJzlZsdpThu+L2Cdzw9aFumhsBY7tHkI:hxTNDHsTlL2eF9sB6l

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 4340	2268	rundll32.exe	80
PID 2268 wrote to memory of 4340	2268	rundll32.exe	80
PID 2268 wrote to memory of 4340	2268	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9544fc60ab46d3b9d50749767e186d8f1cc4b572a6a6e2a01a38a137b24301da.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9544fc60ab46d3b9d50749767e186d8f1cc4b572a6a6e2a01a38a137b24301da.dll,#1
  2⤵
  PID:4340