dd9f6dc62d4e577b7020dfc0d1ec7e705798d9f43b493137def3507e2daf3a3e

Analysis

max time kernel
129s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 21:45

Target

dd9f6dc62d4e577b7020dfc0d1ec7e705798d9f43b493137def3507e2daf3a3e.dll
Size

6KB
MD5

39aab0e304e68aed03def10a85460dc0
SHA1

0860dbf970d1a56a693ce0ba0604c91235832c28
SHA256

dd9f6dc62d4e577b7020dfc0d1ec7e705798d9f43b493137def3507e2daf3a3e
SHA512

208fcdc06581a4c9d0f37d89080c17b1ce5fd37688a3d75e02aac8339ee82deee0898bb67137ec7fac21a557f712331e2e52ad1def44cfe9ff0051f5f79baae8
SSDEEP

96:nEY2RrF1eqwi4aRldkyp4S0LJNE4tMrUC18:EHRh1epptaOs4EUO

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1780 wrote to memory of 1792	1780	rundll32.exe	79
PID 1780 wrote to memory of 1792	1780	rundll32.exe	79
PID 1780 wrote to memory of 1792	1780	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd9f6dc62d4e577b7020dfc0d1ec7e705798d9f43b493137def3507e2daf3a3e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1780
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd9f6dc62d4e577b7020dfc0d1ec7e705798d9f43b493137def3507e2daf3a3e.dll,#1
  2⤵
  PID:1792