0dd93f9f277b14a36c766e820ed1e9632ad01661b8391aa9c4a977d7d5981556

Analysis

max time kernel
189s
max time network
209s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 05:12

Target

0dd93f9f277b14a36c766e820ed1e9632ad01661b8391aa9c4a977d7d5981556.dll
Size

5KB
MD5

965a3250aba1e810f374a62572958bd0
SHA1

c522c46a25a618946a8cd8a3a20642893847492c
SHA256

0dd93f9f277b14a36c766e820ed1e9632ad01661b8391aa9c4a977d7d5981556
SHA512

be20c0000ee79ab0bcc3107d979f5aaaa0cc7e2ba167f0f4fb2bb4ffefeec29c1f11ae0844b622207a881d53bd3231d952acf2ece2213edd812bfb319e64bec8
SSDEEP

96:XprYDpKnI6wJ+Ls7guyHejyn/I9l0iaiPtnMF:XUcA+ggd+W/If0i9tnM

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4604 wrote to memory of 4752	4604	rundll32.exe	82
PID 4604 wrote to memory of 4752	4604	rundll32.exe	82
PID 4604 wrote to memory of 4752	4604	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0dd93f9f277b14a36c766e820ed1e9632ad01661b8391aa9c4a977d7d5981556.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4604
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0dd93f9f277b14a36c766e820ed1e9632ad01661b8391aa9c4a977d7d5981556.dll,#1
  2⤵
  PID:4752