d73fc1a3751bf997d2d73dc20f5230d944354f714bf504f0dedfe728f3316cf8

Analysis

max time kernel
173s
max time network
187s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2022 11:41

Target

d73fc1a3751bf997d2d73dc20f5230d944354f714bf504f0dedfe728f3316cf8.dll
Size

6KB
MD5

a6ad1b2136fdd7801012169d549dfd70
SHA1

60ee0ada3093b6d967718845277f4de3b9ce3e50
SHA256

d73fc1a3751bf997d2d73dc20f5230d944354f714bf504f0dedfe728f3316cf8
SHA512

856628795d19a88dbea1e534bedf01889b1867813dd7e0b97d827d97e054961aa593beb4f2e6d3b426f9c47cf7ac103221892bfa1d5622436f6a46f7576521da
SSDEEP

96:FtrRdrY0x7+PZSylzJ3AcLmnU9CPaDfli0Sg4iY1eBPRRgAUzW/1LCDe:Ft11+PdlTWQEQNi0gEOe

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3544 wrote to memory of 2324	3544	rundll32.exe	80
PID 3544 wrote to memory of 2324	3544	rundll32.exe	80
PID 3544 wrote to memory of 2324	3544	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d73fc1a3751bf997d2d73dc20f5230d944354f714bf504f0dedfe728f3316cf8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3544
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d73fc1a3751bf997d2d73dc20f5230d944354f714bf504f0dedfe728f3316cf8.dll,#1
  2⤵
  PID:2324