97bb03ead1bdf56ed3b2783be0c8ac5bd4e35a8341f25bb7f55d72efb5850bb4

Analysis

max time kernel
144s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 00:49

Target

97bb03ead1bdf56ed3b2783be0c8ac5bd4e35a8341f25bb7f55d72efb5850bb4.dll
Size

120KB
MD5

c598060e37ad29709488a4aff706e157
SHA1

7a3f2c6790b9253bd56975c3ec9db773ef5275a0
SHA256

97bb03ead1bdf56ed3b2783be0c8ac5bd4e35a8341f25bb7f55d72efb5850bb4
SHA512

b0d5b2e70f5d55dfa74fa41a1f6e3acdd959c7cda23e795aeb4b680aa30e78cb415c0c7a251f033acb34145d05bff601d4ddfa793cb435feed90f6e4e70ae39a
SSDEEP

1536:UpP0ZeL6Dbt/0SMy0E70SGOiZYPYCV8DhUD8h4ana6s20liJOgPNSgZs5N2:Pe+Dbt/6SGVw1kK8eanXs20liJAN

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4988 wrote to memory of 2044	4988	rundll32.exe	81
PID 4988 wrote to memory of 2044	4988	rundll32.exe	81
PID 4988 wrote to memory of 2044	4988	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\97bb03ead1bdf56ed3b2783be0c8ac5bd4e35a8341f25bb7f55d72efb5850bb4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\97bb03ead1bdf56ed3b2783be0c8ac5bd4e35a8341f25bb7f55d72efb5850bb4.dll,#1
  2⤵
  PID:2044