97fa3d2ad1220300e2b44d196c05363dbe8bfe6ce40f1e043f142f0e8b167817

Analysis

max time kernel
183s
max time network
198s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 16:50

Target

97fa3d2ad1220300e2b44d196c05363dbe8bfe6ce40f1e043f142f0e8b167817.dll
Size

52KB
MD5

5bee197b6cb8030114b9120a365e475a
SHA1

a95c67d2907be44738699fcd3bc0be2486d985ab
SHA256

97fa3d2ad1220300e2b44d196c05363dbe8bfe6ce40f1e043f142f0e8b167817
SHA512

9740335eb7d3d704bb9eca9e2a95b6b0be6bbbe9c02a89c43d8633d546e89c09c82324361071b7aa29d553c1503fb1c079d50dfeb21dfd26b89bcb6ff4572e46
SSDEEP

1536:OBRVgrExucMlPoBU2hHIBWun78tTj0apKj:ERRs7LBHSTJS

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4780 wrote to memory of 2172	4780	rundll32.exe	78
PID 4780 wrote to memory of 2172	4780	rundll32.exe	78
PID 4780 wrote to memory of 2172	4780	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\97fa3d2ad1220300e2b44d196c05363dbe8bfe6ce40f1e043f142f0e8b167817.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4780
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\97fa3d2ad1220300e2b44d196c05363dbe8bfe6ce40f1e043f142f0e8b167817.dll,#1
  2⤵
  PID:2172