931b01927ac37f831f9fedc069daf186632d5c046b3f2be71c768c95bb7ab54f

Analysis

max time kernel
251s
max time network
330s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 02:10

Target

931b01927ac37f831f9fedc069daf186632d5c046b3f2be71c768c95bb7ab54f.dll
Size

6KB
MD5

64897b0863265c9d3ddc5d07aca47020
SHA1

a7d21681914a3d620a493da14e1a75121bf46ef7
SHA256

931b01927ac37f831f9fedc069daf186632d5c046b3f2be71c768c95bb7ab54f
SHA512

8a9d62e890147b740f66138f79d99e4b17a634f33a48ca02bdd501bd11cabed6a3cdb3616d2924b78383cac280f14fabdc517b16ccb3c94b3dd1e19e857d3e69
SSDEEP

96:DixZjmjtjd8jPjcZGR5TIaASuzSTDhbEjaSbQj:unSR6bgY

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1920 wrote to memory of 5112	1920	rundll32.exe	80
PID 1920 wrote to memory of 5112	1920	rundll32.exe	80
PID 1920 wrote to memory of 5112	1920	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\931b01927ac37f831f9fedc069daf186632d5c046b3f2be71c768c95bb7ab54f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1920
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\931b01927ac37f831f9fedc069daf186632d5c046b3f2be71c768c95bb7ab54f.dll,#1
  2⤵
  PID:5112