dfd217dc006102a2cb9b88d081ea8d901c160690ac71735caebe13a92eaceb16

Analysis

max time kernel
169s
max time network
177s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 22:12

Target
dfd217dc006102a2cb9b88d081ea8d901c160690ac71735caebe13a92eaceb16.dll
Size 5KB
Sample221203-14wcqaaa95
SHA256 dfd217dc006102a2cb9b88d081ea8d901c160690ac71735caebe13a92eaceb16
MD5 0e6af8ee6311438155cb0d61b2dd7d80
SHA1 4e3467d7d6324598fbd65a1b44302a3534b2da1e
SHA512 89ce37d8f17dd1d35d6120bec1426a6ce657e66403482236486ed0d2dd1599fbf81090f8a8ab7f1d9faf0b6f119d941c4468a27353459166218ebd294e5f611a
SSDEEP 96:XprYDpKnI6wJ+Ls7guyHejyn/I9l0iaiy62smfj:XUcA+ggd+W/If0iNNmfj
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4244 wrote to memory of 3384	4244	rundll32.exe	79
PID 4244 wrote to memory of 3384	4244	rundll32.exe	79
PID 4244 wrote to memory of 3384	4244	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dfd217dc006102a2cb9b88d081ea8d901c160690ac71735caebe13a92eaceb16.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4244
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dfd217dc006102a2cb9b88d081ea8d901c160690ac71735caebe13a92eaceb16.dll,#1
  2⤵
  PID:3384