b16db97b825304a02bd7ad6bc48798eae64588b9ba267522d83d8de8acdb5ca9

Analysis

max time kernel
158s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 05:15

Target
b16db97b825304a02bd7ad6bc48798eae64588b9ba267522d83d8de8acdb5ca9.dll
Size 5KB
Sample221129-fxmf1shb32
SHA256 b16db97b825304a02bd7ad6bc48798eae64588b9ba267522d83d8de8acdb5ca9
MD5 783671a82eec8faea0780aa2780cfde0
SHA1 9fd1145652fbe04bdc9e506f6e1b196bea14f8e1
SHA512 8f77aec418ef5f9583e5cf5d584f1964e0b1c88779e0e0cec32bcac61c91321aa28c90c09ef3c215ce691b1e8a0dd12c3e745cff56918c699decd04fcda5839c
SSDEEP 96:z0I9wZLrY0/c2Y1MNwhOoYlDmLN8mWH+5QZvCofWHx9yapW9Pk9a:JKZWN1PN5x7s+5QZvRfWHx9yaY9Pk9a
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3436 wrote to memory of 3384	3436	rundll32.exe	79
PID 3436 wrote to memory of 3384	3436	rundll32.exe	79
PID 3436 wrote to memory of 3384	3436	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b16db97b825304a02bd7ad6bc48798eae64588b9ba267522d83d8de8acdb5ca9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3436
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b16db97b825304a02bd7ad6bc48798eae64588b9ba267522d83d8de8acdb5ca9.dll,#1
  2⤵
  PID:3384