8772c7d9b20058904b8abb616e370e0c26931b6bd1e5221059d9c8a78a265a72

Analysis

max time kernel
91s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 21:53

Target

8772c7d9b20058904b8abb616e370e0c26931b6bd1e5221059d9c8a78a265a72.dll
Size

5KB
MD5

9e088d42c2765caa3d279a7b12764a70
SHA1

2a6844f766c5f9648ba9c14d189a19df787dc69d
SHA256

8772c7d9b20058904b8abb616e370e0c26931b6bd1e5221059d9c8a78a265a72
SHA512

8531011be65cad74ca7642836489af5cd0e0c6a7fc2fe912ca967ff6df8e3589163dbe41d57f2244c4a3208e89aa669462c493ed362328bfb6aebc47e184b65e
SSDEEP

96:nEY2RrF1eqwi43DxemfiaHRHOtq1/KHBwDaft/y63Jb8Oy:EHRh1epp3fRaqGBck/y6Zbf

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5012 wrote to memory of 4896	5012	rundll32.exe	80
PID 5012 wrote to memory of 4896	5012	rundll32.exe	80
PID 5012 wrote to memory of 4896	5012	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8772c7d9b20058904b8abb616e370e0c26931b6bd1e5221059d9c8a78a265a72.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5012
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8772c7d9b20058904b8abb616e370e0c26931b6bd1e5221059d9c8a78a265a72.dll,#1
  2⤵
  PID:4896