ff119c933233f797d71ffdecbbfad6b8c6d0af2d8199f38c821be89b216925b0

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2022 01:30

Target

ff119c933233f797d71ffdecbbfad6b8c6d0af2d8199f38c821be89b216925b0.dll
Size

61KB
MD5

3abbfd9e4aca48d184e5907d50544587
SHA1

09795f359a4da196e3dd35e80d28491ef4c71a37
SHA256

ff119c933233f797d71ffdecbbfad6b8c6d0af2d8199f38c821be89b216925b0
SHA512

bde27b8e6e5d0ad046581706aaf8ce28aa487451644d0b4efc07bd1c015528a4fb71b6986c3ce1a7bdc3af8090f6d45b37a50f1e9ada019ffe2450e555991d4e
SSDEEP

1536:1zExMwCGQ2jwzQceHH8T5TUMNaOwR7yhOfJF0zX9e:1I+wCGv8R6HS5TtCR+y0js

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 796 wrote to memory of 820	796	rundll32.exe	81
PID 796 wrote to memory of 820	796	rundll32.exe	81
PID 796 wrote to memory of 820	796	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ff119c933233f797d71ffdecbbfad6b8c6d0af2d8199f38c821be89b216925b0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:796
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ff119c933233f797d71ffdecbbfad6b8c6d0af2d8199f38c821be89b216925b0.dll,#1
  2⤵
  PID:820