94504639ba97cefac3596746d3ae40d09bdc16cd3b3b8008ade417f2447af013

Analysis

max time kernel
253s
max time network
311s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 21:27

Target

94504639ba97cefac3596746d3ae40d09bdc16cd3b3b8008ade417f2447af013.dll
Size

70KB
MD5

6a9b3f86c2ed55075fee7cfb87bb4faf
SHA1

c491343bb78f4d19f7ecaecb37d2a89e2f53927e
SHA256

94504639ba97cefac3596746d3ae40d09bdc16cd3b3b8008ade417f2447af013
SHA512

c04824b4a4e6857dd4abf61ae5cc708aa48ff4fa690a9acc860d3e57dd9e5806ca0ed7b4fd43f43581a3cb0c7e70cbc70bd44afdca2d6859aec4fb4c81e08a96
SSDEEP

1536:yok0mU99hODEJE1opQn2v6a1uR/fgsQZsSKN1yZn:/massEvn06a12fgsjSKNcZn

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4244 wrote to memory of 2712	4244	rundll32.exe	80
PID 4244 wrote to memory of 2712	4244	rundll32.exe	80
PID 4244 wrote to memory of 2712	4244	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\94504639ba97cefac3596746d3ae40d09bdc16cd3b3b8008ade417f2447af013.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4244
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\94504639ba97cefac3596746d3ae40d09bdc16cd3b3b8008ade417f2447af013.dll,#1
  2⤵
  PID:2712