92f5d28ad0797b130f91a19f6f3c41f295b580d4f2ff601e713c434dd1606536

Analysis

max time kernel
91s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
02-12-2022 02:10

Target

92f5d28ad0797b130f91a19f6f3c41f295b580d4f2ff601e713c434dd1606536.dll
Size

4KB
MD5

7c1b25e904c6edfba585787a5fcaed80
SHA1

e3ea0677685d99e8fb4e7ea4d6288bbe32b16127
SHA256

92f5d28ad0797b130f91a19f6f3c41f295b580d4f2ff601e713c434dd1606536
SHA512

f8d20f4cf429aa5073d98e18f84cbcf24105cdbc4fec1e6ad5afe2e530283e177fde717b308ec6707c421608e6b70e4197e164087ede088577c03212ef7560d3
SSDEEP

48:a5zuMqBcq06phM/wwWLSeJY8JTa6Il+LYLeScEljoLx2VFDtW8+uS4yMt:TRphMzf8YqSB2Ls/I8zS4H

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3376 wrote to memory of 1016	3376	rundll32.exe	69
PID 3376 wrote to memory of 1016	3376	rundll32.exe	69
PID 3376 wrote to memory of 1016	3376	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\92f5d28ad0797b130f91a19f6f3c41f295b580d4f2ff601e713c434dd1606536.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3376
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\92f5d28ad0797b130f91a19f6f3c41f295b580d4f2ff601e713c434dd1606536.dll,#1
  2⤵
  PID:1016