11f16e669c410bb6384cb464f93e95647ff312b06e2b46801166bd16e6108b69

Analysis

max time kernel
91s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 01:22

Target

11f16e669c410bb6384cb464f93e95647ff312b06e2b46801166bd16e6108b69.dll
Size

6KB
MD5

36fcb0f2aa94c923c7da18b651c0cd40
SHA1

3982bc2ae37e7d6562278de701f9d16431dc5224
SHA256

11f16e669c410bb6384cb464f93e95647ff312b06e2b46801166bd16e6108b69
SHA512

7aa76909a5e0ea11211a7c5197cab9d61766e091f8330cb18152729bc9c10cdceaa72f73bd72caf20beed5b893a07534a216dfdffb5c99810e4a48b32bd44001
SSDEEP

96:nGTKrYJyJ5gT9jXk9eXWI/n9e1r/CVd7p0jsnmUD7PVKPx:nGTWJGp0UZUd6378snt7tw

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4920 wrote to memory of 4904	4920	rundll32.exe	82
PID 4920 wrote to memory of 4904	4920	rundll32.exe	82
PID 4920 wrote to memory of 4904	4920	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\11f16e669c410bb6384cb464f93e95647ff312b06e2b46801166bd16e6108b69.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4920
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\11f16e669c410bb6384cb464f93e95647ff312b06e2b46801166bd16e6108b69.dll,#1
  2⤵
  PID:4904