d73fc1a3751bf997d2d73dc20f5230d944354f714bf504f0dedfe728f3316cf8

Analysis

max time kernel
173s
max time network
187s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 11:41

Target
d73fc1a3751bf997d2d73dc20f5230d944354f714bf504f0dedfe728f3316cf8.dll
Size 6KB
Sample221205-ntwvaaah7v
SHA256 d73fc1a3751bf997d2d73dc20f5230d944354f714bf504f0dedfe728f3316cf8
MD5 a6ad1b2136fdd7801012169d549dfd70
SHA1 60ee0ada3093b6d967718845277f4de3b9ce3e50
SHA512 856628795d19a88dbea1e534bedf01889b1867813dd7e0b97d827d97e054961aa593beb4f2e6d3b426f9c47cf7ac103221892bfa1d5622436f6a46f7576521da
SSDEEP 96:FtrRdrY0x7+PZSylzJ3AcLmnU9CPaDfli0Sg4iY1eBPRRgAUzW/1LCDe:Ft11+PdlTWQEQNi0gEOe
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3544 wrote to memory of 2324	3544	rundll32.exe	80
PID 3544 wrote to memory of 2324	3544	rundll32.exe	80
PID 3544 wrote to memory of 2324	3544	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d73fc1a3751bf997d2d73dc20f5230d944354f714bf504f0dedfe728f3316cf8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3544
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d73fc1a3751bf997d2d73dc20f5230d944354f714bf504f0dedfe728f3316cf8.dll,#1
  2⤵
  PID:2324