d96ae3ef96532ab1953d30c1884b593b67efe629216f294717e601f686d18e12

Analysis

max time kernel
165s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 01:32

Target

d96ae3ef96532ab1953d30c1884b593b67efe629216f294717e601f686d18e12.dll
Size

91KB
MD5

acab6f16a1ff5d5a0be4fc339e4aad9e
SHA1

b3696093ff7200fab53648d9bacd520eb3df1f5e
SHA256

d96ae3ef96532ab1953d30c1884b593b67efe629216f294717e601f686d18e12
SHA512

a6585aff998d7152291b6a1177c15c763dcfb0b683a718ef47b8d40c9e60a3027924da5f5cff299ed08862d1b649cb34be7a7ec2ae75dd6033b78986534c3745
SSDEEP

1536:WUhfYQEmm8aMsVZZaLoR1NObtFJW9Xy/HRjr0DsXc5Di:5gQEmmMsVZZ/R1sXMMHRED0c5Di

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 560	3020	rundll32.exe	41
PID 3020 wrote to memory of 560	3020	rundll32.exe	41
PID 3020 wrote to memory of 560	3020	rundll32.exe	41

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d96ae3ef96532ab1953d30c1884b593b67efe629216f294717e601f686d18e12.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d96ae3ef96532ab1953d30c1884b593b67efe629216f294717e601f686d18e12.dll,#1
  2⤵
  PID:560