de9f99acc6b0a9df88f8ba9fae95bad33fb5774c4af09438be0c69a4bec644cc

Analysis

max time kernel
146s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02-12-2022 19:22

Target

de9f99acc6b0a9df88f8ba9fae95bad33fb5774c4af09438be0c69a4bec644cc.dll
Size

64KB
MD5

fb9138486b656cd7972a9647bf1c30ae
SHA1

c4fe9c1702bc63a414b7407920df177beb6a8a75
SHA256

de9f99acc6b0a9df88f8ba9fae95bad33fb5774c4af09438be0c69a4bec644cc
SHA512

ff5ddb1c8f6cf656f1574d88a1ba134b4ccbe2708b5a8a89158b3c971db57bbba653454f176c23481aa3522ad5f1aebe99b7ee1e5cf256a28d0ac47568dc10ae
SSDEEP

1536:yHZgTK5+JA6GF2Hxwsrdy/pfMlTc0O351R:yHSTK8JfGFYr0so045j

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 4844	2024	rundll32.exe	84
PID 2024 wrote to memory of 4844	2024	rundll32.exe	84
PID 2024 wrote to memory of 4844	2024	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\de9f99acc6b0a9df88f8ba9fae95bad33fb5774c4af09438be0c69a4bec644cc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\de9f99acc6b0a9df88f8ba9fae95bad33fb5774c4af09438be0c69a4bec644cc.dll,#1
  2⤵
  PID:4844