956ffb4f6488f3a3d42347bb93d093936e7372b496694968ea1dc8afea7dddab

Analysis

max time kernel
91s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 04:34

Target

956ffb4f6488f3a3d42347bb93d093936e7372b496694968ea1dc8afea7dddab.dll
Size

36KB
MD5

ec53bf65cb035733fb1413de64c12a72
SHA1

fc79a3d7012b6d30f0069ac0cb66429fa1df24e2
SHA256

956ffb4f6488f3a3d42347bb93d093936e7372b496694968ea1dc8afea7dddab
SHA512

e3401205beb9eb0d9920ed3068da79c04c780efbba9f9aead7e2558e0b8f271b62754eead13720c8345b32ac37248c843e68c7afb902ab1f8d72f5eee48e4c8f
SSDEEP

768:7mWtf1lkAzsDbNNO+Ba0Z/7MQiSyCLvH/CODbhTR+6Q:7l1lkwK3O4aW7MzSzLvKOhTR+6Q

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 4780	2060	rundll32.exe	80
PID 2060 wrote to memory of 4780	2060	rundll32.exe	80
PID 2060 wrote to memory of 4780	2060	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\956ffb4f6488f3a3d42347bb93d093936e7372b496694968ea1dc8afea7dddab.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\956ffb4f6488f3a3d42347bb93d093936e7372b496694968ea1dc8afea7dddab.dll,#1
  2⤵
  PID:4780