961f16c8cc1567e87b68745aac12f7b824f4c05668038c940bae758edce0aa4e

Analysis

max time kernel
240s
max time network
260s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 22:40

Target

961f16c8cc1567e87b68745aac12f7b824f4c05668038c940bae758edce0aa4e.dll
Size

4KB
MD5

3ee025b441833486450f53e143a8d300
SHA1

afc95db0d758acb5c43a1d505df856f7ffedef3e
SHA256

961f16c8cc1567e87b68745aac12f7b824f4c05668038c940bae758edce0aa4e
SHA512

240114f84b0312a67548ab6220600a4c1850ee7ff275c064b7f6e79117c2133376cf79d1ea815a4df0b8a156ae5e00a53d00121782a5166efa3420e4c308f30f
SSDEEP

48:SWkO0IoyTnXz+ihZjokbnZCyW2PH8kTvJ:ZJTnXzvokVCyWtkTR

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3076 wrote to memory of 1968	3076	rundll32.exe	82
PID 3076 wrote to memory of 1968	3076	rundll32.exe	82
PID 3076 wrote to memory of 1968	3076	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\961f16c8cc1567e87b68745aac12f7b824f4c05668038c940bae758edce0aa4e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3076
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\961f16c8cc1567e87b68745aac12f7b824f4c05668038c940bae758edce0aa4e.dll,#1
  2⤵
  PID:1968