9bab1fd05b039c5d479aa201567c35982b7650edf4de081530756301ad3487c5

Analysis

max time kernel
183s
max time network
206s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 21:51

Target

9bab1fd05b039c5d479aa201567c35982b7650edf4de081530756301ad3487c5.dll
Size

6KB
MD5

f6a33d6d502f097c660b42d5809fffa0
SHA1

4f8fdd6e1b26778b007378eb43f731e84ce0f1d9
SHA256

9bab1fd05b039c5d479aa201567c35982b7650edf4de081530756301ad3487c5
SHA512

c195c92a02e6d7ad7ef4b5bbe1b7a4405c0db22cbe8b95049ebb63cde7d4f0a8baf2b9a68a1666ba92a414706d2b072015c68d22198452560ecdb08fab4d23a5
SSDEEP

96:nEY2RrF1eqwi42b0nr47hMD74RIbkZHB:EHRh1eppVkIuH

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1580 wrote to memory of 1572	1580	rundll32.exe	82
PID 1580 wrote to memory of 1572	1580	rundll32.exe	82
PID 1580 wrote to memory of 1572	1580	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9bab1fd05b039c5d479aa201567c35982b7650edf4de081530756301ad3487c5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1580
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9bab1fd05b039c5d479aa201567c35982b7650edf4de081530756301ad3487c5.dll,#1
  2⤵
  PID:1572