9dfe822525620c0c925dc543c6b70923c0193db947cdfc068b9525848978afdb

Analysis

max time kernel
256s
max time network
354s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 11:07

Target

9dfe822525620c0c925dc543c6b70923c0193db947cdfc068b9525848978afdb.dll
Size

148KB
MD5

d6f58392fb63fe33b12ccdcc2c734646
SHA1

e7f75ad0bdf3edb534d0a9674896901253840b96
SHA256

9dfe822525620c0c925dc543c6b70923c0193db947cdfc068b9525848978afdb
SHA512

c93676c4add7bbb53f4d8419cff5613db5ef56c3c9cac1f78827f066adc1dc625635dfcd40c92ced97cdb1f0a8ec1e9260621060b042672fa619d16c9e92832f
SSDEEP

3072:uNa3mOoUpyUNTbR9/oPW6sRSo4WMy6GoOIO:uE3nhUUvpeyn

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1564 wrote to memory of 408	1564	rundll32.exe	80
PID 1564 wrote to memory of 408	1564	rundll32.exe	80
PID 1564 wrote to memory of 408	1564	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9dfe822525620c0c925dc543c6b70923c0193db947cdfc068b9525848978afdb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1564
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9dfe822525620c0c925dc543c6b70923c0193db947cdfc068b9525848978afdb.dll,#1
  2⤵
  PID:408