f9055d737d89759d1b3b1d08ea738d5173466b21daec68456f6c9f3cd027c326

Analysis

max time kernel
174s
max time network
203s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 00:53

Target
f9055d737d89759d1b3b1d08ea738d5173466b21daec68456f6c9f3cd027c326.dll
Size 6KB
Sample221206-a8q1pacf72
SHA256 f9055d737d89759d1b3b1d08ea738d5173466b21daec68456f6c9f3cd027c326
MD5 3f5a4bea5c3a914ccca6fb79bab269d0
SHA1 3481dfef8d6e41ad01f641777f932d60d7ee15a6
SHA512 14d8fd1edf1e5f6cda84e05739d3a703f710e8071f268eec9c35610876db4385f5098908484c191163387275427919c7b80c4736de75828eaa82a017f8eca77d
SSDEEP 48:CCyEjm9/26xBs/klS4rklShklSK8klS3klSTIZGOixlEBhM:hyZxm/jmjhjvj3jcZGV4
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2728 wrote to memory of 508	2728	rundll32.exe	79
PID 2728 wrote to memory of 508	2728	rundll32.exe	79
PID 2728 wrote to memory of 508	2728	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f9055d737d89759d1b3b1d08ea738d5173466b21daec68456f6c9f3cd027c326.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f9055d737d89759d1b3b1d08ea738d5173466b21daec68456f6c9f3cd027c326.dll,#1
  2⤵
  PID:508