d9a4db75d8d58f823379ee771db4a8a49f0707549be651e35c09579ef267cd56

Analysis

max time kernel
150s
max time network
205s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 00:43

Target

d9a4db75d8d58f823379ee771db4a8a49f0707549be651e35c09579ef267cd56.dll
Size

44KB
MD5

f4870416e4f136faf65172553f090537
SHA1

4cac2ea0402e7c03f68cf863ac21ba4d1ed28856
SHA256

d9a4db75d8d58f823379ee771db4a8a49f0707549be651e35c09579ef267cd56
SHA512

70b25aac222b6a77d7c23b0f781d75683a8d6e0cefa0af3d799f2c3d9fd02033c8e0ad4ac30833319b7e603a882f242fc868d35f2578c4a51ea0e460e958a2ec
SSDEEP

768:1zExMf4sJGHw2jnUkzgZ/QvK4A0a7cxh00oDpF6WWwQmgjsFAfT/+pLAt:1zExMwCGQ2jU2gZ/6HqBHNF6WbQhjnWG

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 2836	2972	rundll32.exe	82
PID 2972 wrote to memory of 2836	2972	rundll32.exe	82
PID 2972 wrote to memory of 2836	2972	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d9a4db75d8d58f823379ee771db4a8a49f0707549be651e35c09579ef267cd56.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d9a4db75d8d58f823379ee771db4a8a49f0707549be651e35c09579ef267cd56.dll,#1
  2⤵
  PID:2836