0fffec39689c81f30b329298b4fa8861905234da3f346cc3a95212b452b7afd7

Analysis

max time kernel
226s
max time network
278s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 23:20

Target

0fffec39689c81f30b329298b4fa8861905234da3f346cc3a95212b452b7afd7.dll
Size

7KB
MD5

4ae28dd0f95defa17bfa9cb12d065af0
SHA1

dcab46df7103900b10892e2c2da1f714ef7cc40d
SHA256

0fffec39689c81f30b329298b4fa8861905234da3f346cc3a95212b452b7afd7
SHA512

10510989060113ac2bfda7cf0d8a70cc23be769c325cb83271e504e97c7756524fb1d657bf970009113aa418c77941f9aa7d4e73e07d01b005446a10d03feb01
SSDEEP

96:hyZxm/jmjhjvj3jcZGV4ClRBubnQNs6CWvjzJxUeNzktFHin4:2M/SdjbgY3BubnCBUeNotFH

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 2428	2992	rundll32.exe	80
PID 2992 wrote to memory of 2428	2992	rundll32.exe	80
PID 2992 wrote to memory of 2428	2992	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0fffec39689c81f30b329298b4fa8861905234da3f346cc3a95212b452b7afd7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0fffec39689c81f30b329298b4fa8861905234da3f346cc3a95212b452b7afd7.dll,#1
  2⤵
  PID:2428