0c1089f1c68904e5605f1f96841dc566f185938c7e08dec25d03229ba51bd4ab

Analysis

max time kernel
91s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2022 11:28

Target

0c1089f1c68904e5605f1f96841dc566f185938c7e08dec25d03229ba51bd4ab.dll
Size

6KB
MD5

a87be6773e50a891ad4ddaefab2a2e80
SHA1

ce86f8ac01e8bd33ede1451a1e349ae941aafd9f
SHA256

0c1089f1c68904e5605f1f96841dc566f185938c7e08dec25d03229ba51bd4ab
SHA512

a748b6f0938c6c94e21ce561dbca3639a18318fb69117a563cc2c5ca0dc2e8be5b619c3faa4d506d7c1063e9c9afb2acc2e0bc1a738cfdbaaeabf5c3144bd874
SSDEEP

48:C6VonAHso6U7lYa92RrpjwDmetlG95hx+iMHhS8JzqcLEB0cl337zGNZ3Fm/zJ6l:nEY2RrF1eqwi40w/Q1Gr3c7ZKHX

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4996 wrote to memory of 4316	4996	rundll32.exe	40
PID 4996 wrote to memory of 4316	4996	rundll32.exe	40
PID 4996 wrote to memory of 4316	4996	rundll32.exe	40

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0c1089f1c68904e5605f1f96841dc566f185938c7e08dec25d03229ba51bd4ab.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4996
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0c1089f1c68904e5605f1f96841dc566f185938c7e08dec25d03229ba51bd4ab.dll,#1
  2⤵
  PID:4316