b9a6fa5df1bd6bd7ba78ea7471deafbd8c3bac912485d012ae87f68a98d645a7

Analysis

max time kernel
142s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 22:27

Target

b9a6fa5df1bd6bd7ba78ea7471deafbd8c3bac912485d012ae87f68a98d645a7.dll
Size

5KB
MD5

1701166c2796934db03f367eac1b9430
SHA1

94ed1f316d38946ae350ef1f6e1a4251639b14c6
SHA256

b9a6fa5df1bd6bd7ba78ea7471deafbd8c3bac912485d012ae87f68a98d645a7
SHA512

a6a679d28e834b2fc13322ba3aa982be07f95fb610e864e6bbb69ff0b7009744a62a328ca751213e1e62796b887aca693ff00d846a505f3c30abd98e4a4c4481
SSDEEP

96:z0B96BLIzEfHllWfo9ebwQ5M4jmu2p/rJ:oEkQ15Q5MeD2xJ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4216 wrote to memory of 4576	4216	rundll32.exe	80
PID 4216 wrote to memory of 4576	4216	rundll32.exe	80
PID 4216 wrote to memory of 4576	4216	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b9a6fa5df1bd6bd7ba78ea7471deafbd8c3bac912485d012ae87f68a98d645a7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4216
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b9a6fa5df1bd6bd7ba78ea7471deafbd8c3bac912485d012ae87f68a98d645a7.dll,#1
  2⤵
  PID:4576