d9788b2d0303a1dbfe94c79367ed38aae94e2221f657b08c98aeeb28ec932937

Analysis

max time kernel
151s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 22:14

Target

d9788b2d0303a1dbfe94c79367ed38aae94e2221f657b08c98aeeb28ec932937.dll
Size

5KB
MD5

3fa6e5c928cd7ed944ea02c4c004bea0
SHA1

5f9f1927df296d8f10ddc080dbfcbf42caddead8
SHA256

d9788b2d0303a1dbfe94c79367ed38aae94e2221f657b08c98aeeb28ec932937
SHA512

fe968a7cd80c6840e016391e3c23dd53179c6f1993d47b8d678fdb58290f0551627748c23d543123b6fa68f5feb4358505b8399ca1cc56b7903366f9c34652d9
SSDEEP

96:z0QR9B6BvAwb8h6IrNrgr0rgkfrg+A8a+OxYH97w:JR94/bI6IrNrgr0rgkfrg+ArxYH97w

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3528 wrote to memory of 1036	3528	rundll32.exe	79
PID 3528 wrote to memory of 1036	3528	rundll32.exe	79
PID 3528 wrote to memory of 1036	3528	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d9788b2d0303a1dbfe94c79367ed38aae94e2221f657b08c98aeeb28ec932937.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3528
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d9788b2d0303a1dbfe94c79367ed38aae94e2221f657b08c98aeeb28ec932937.dll,#1
  2⤵
  PID:1036