94b6d10df190cb8ecd2b75af65433aac27978d1c4004561b08047ca2abdaf0f3

Analysis

max time kernel
164s
max time network
185s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 06:01

Target

94b6d10df190cb8ecd2b75af65433aac27978d1c4004561b08047ca2abdaf0f3.dll
Size

44KB
MD5

5e59c761eb5600fc096d65432fdb6c11
SHA1

6f32e81191de8e68ad6b2787f02dd66c68864b75
SHA256

94b6d10df190cb8ecd2b75af65433aac27978d1c4004561b08047ca2abdaf0f3
SHA512

ac06a6e22586209ed874028c050b3197f9b1e2369f387fc8315b2534dcad655345b000038c7deb13c09f91c43aa58a89443a5382e4842c281b2e0a04f81ed3c5
SSDEEP

384:D2y6K867Tn9i6+Xiyo07PEWUJOoH8HoI0I/YDLtuSAPcWPnofgULnYHKh:o967Tn91+SjXQoHy7YDLtiPno2M

Score

1^/10

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5020 wrote to memory of 852	5020	rundll32.exe	81
PID 5020 wrote to memory of 852	5020	rundll32.exe	81
PID 5020 wrote to memory of 852	5020	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\94b6d10df190cb8ecd2b75af65433aac27978d1c4004561b08047ca2abdaf0f3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\94b6d10df190cb8ecd2b75af65433aac27978d1c4004561b08047ca2abdaf0f3.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:852