764f86bfaf98a34abaff4338dbc8510bf2cc5113793bf3d76be224e8a1774852

Analysis

max time kernel
91s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
02-12-2022 02:17

Target

764f86bfaf98a34abaff4338dbc8510bf2cc5113793bf3d76be224e8a1774852.dll
Size

6KB
MD5

9e540efa3936821d87ccc3236e1821f0
SHA1

d584e8e854a360f6296cb9907660f794d3b5973b
SHA256

764f86bfaf98a34abaff4338dbc8510bf2cc5113793bf3d76be224e8a1774852
SHA512

76130153d4636df34be1e2ba529e2da09197ef5675bd8b86772e7b72b373cbec2aaab93028976590daee4847237d21355d1a9604eec30da0b373c6f5b2006bda
SSDEEP

96:DixZjmjtjd8jPjcZGR5TIlzW7GbOG2ie3n7aR:unSR6bgY

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1616 wrote to memory of 4900	1616	rundll32.exe	80
PID 1616 wrote to memory of 4900	1616	rundll32.exe	80
PID 1616 wrote to memory of 4900	1616	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\764f86bfaf98a34abaff4338dbc8510bf2cc5113793bf3d76be224e8a1774852.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1616
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\764f86bfaf98a34abaff4338dbc8510bf2cc5113793bf3d76be224e8a1774852.dll,#1
  2⤵
  PID:4900