93c00724e1a87a440e0bcd00c4b70a897e26bc4f046e7f84688c33b8473d4895

Analysis

max time kernel
92s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 03:41

Target

93c00724e1a87a440e0bcd00c4b70a897e26bc4f046e7f84688c33b8473d4895.dll
Size

76KB
MD5

5ad6d912d0c3fadc3438ce47e4cfaaae
SHA1

0d47a91b89c173407a6b6045be2c0c64b7d62179
SHA256

93c00724e1a87a440e0bcd00c4b70a897e26bc4f046e7f84688c33b8473d4895
SHA512

bc224afcdc13bf24a03e3bcadd8342b431ecb518e3979945c562c0092b4eb483b1f6a184cdcc99e83d7ac37a77c3d56713ed10f8bcda48c650257a5b08d877da
SSDEEP

1536:yl3E0TWEAq5MxvScjP1SI3TqCCs2RTyJO5pr9dFYuxF9z:E39i+5MtrLlDBqsOddFYwF9z

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3108 wrote to memory of 4380	3108	rundll32.exe	80
PID 3108 wrote to memory of 4380	3108	rundll32.exe	80
PID 3108 wrote to memory of 4380	3108	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\93c00724e1a87a440e0bcd00c4b70a897e26bc4f046e7f84688c33b8473d4895.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3108
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\93c00724e1a87a440e0bcd00c4b70a897e26bc4f046e7f84688c33b8473d4895.dll,#1
  2⤵
  PID:4380