9c1de54b04ef07915a3ff68ee3ee1af6d685a561ac3e2525bdee527c15da70fc

Analysis

max time kernel
191s
max time network
180s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 20:33

Target

9c1de54b04ef07915a3ff68ee3ee1af6d685a561ac3e2525bdee527c15da70fc.dll
Size

43KB
MD5

b4af4fad890951b789cb94763eaa636b
SHA1

7a6e77fb32b581f35657e98f1032ecde8cc34b21
SHA256

9c1de54b04ef07915a3ff68ee3ee1af6d685a561ac3e2525bdee527c15da70fc
SHA512

f6d65f20915d3dd6794c6103674394f5228285bc96d4fef6abf9405381a2af4595dc543403a9a600e5f1418c43177f8d8bc406769c64f20d3957deeb8fcffd73
SSDEEP

768:TIaKzebiOXCEaTvHyetTuNQIJ/iwJjVK+fBRWfdTWSjbzRHdAzxFpo9yA/HAf:UaAeDCEaTvHyOyswzTZ4dTLBWdzolHA

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4016 wrote to memory of 2284	4016	rundll32.exe	84
PID 4016 wrote to memory of 2284	4016	rundll32.exe	84
PID 4016 wrote to memory of 2284	4016	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9c1de54b04ef07915a3ff68ee3ee1af6d685a561ac3e2525bdee527c15da70fc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9c1de54b04ef07915a3ff68ee3ee1af6d685a561ac3e2525bdee527c15da70fc.dll,#1
  2⤵
  PID:2284