094690fe3b3a5f5078655003fdd0d0bf8ecc1cd0383a98a393234d4029c8a299

Analysis

max time kernel
238s
max time network
275s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2022 11:28

Target

094690fe3b3a5f5078655003fdd0d0bf8ecc1cd0383a98a393234d4029c8a299.dll
Size

6KB
MD5

adf96d53919bdb65b5e4e427bc6a4cf0
SHA1

7835300d848f150d649ac10961b0421e5fa232a0
SHA256

094690fe3b3a5f5078655003fdd0d0bf8ecc1cd0383a98a393234d4029c8a299
SHA512

ca33925032d4e4bb18e9d14f9bdc61584ca67acb08655111bbf05918c2cfb9ba0d3137d2e188c1b29370f420bcacec7edb45fd64ada338560e1314ece8b1d11c
SSDEEP

96:nEY2RrF1eqwi4PAfmuRn3SKU8ruX5XM+VG+G3U+cxwjSq1U9Z1H:EHRh1eppW3R

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5100 wrote to memory of 3660	5100	rundll32.exe	80
PID 5100 wrote to memory of 3660	5100	rundll32.exe	80
PID 5100 wrote to memory of 3660	5100	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\094690fe3b3a5f5078655003fdd0d0bf8ecc1cd0383a98a393234d4029c8a299.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5100
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\094690fe3b3a5f5078655003fdd0d0bf8ecc1cd0383a98a393234d4029c8a299.dll,#1
  2⤵
  PID:3660