d09d894f0ad9a449d561ea1a3da30054d5ae0036786a9b54ff6604ab1f07a9ac

Analysis

max time kernel
142s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 07:07

Target

d09d894f0ad9a449d561ea1a3da30054d5ae0036786a9b54ff6604ab1f07a9ac.dll
Size

68KB
MD5

8c735d552f1fae6fcbccf46f91949130
SHA1

a90c5848ab9f2d42a623bca729a8d6fb5f2c821d
SHA256

d09d894f0ad9a449d561ea1a3da30054d5ae0036786a9b54ff6604ab1f07a9ac
SHA512

ee039b4b715103a84d2fb17c7db1d77e6f2c57161332475a90195e6b590f6cb193cf11cbe59046e5cd0f2e2b21dfe5713c2f855082ab9606c104a21a82a4ba35
SSDEEP

768:uOaPLg5HhELf6b75KR860Qk4OkBYCkwGlL5h3LVwd1B7:/aPLg5Hh6Q7m8FR2YlZLVwdP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4056 wrote to memory of 4648	4056	rundll32.exe	80
PID 4056 wrote to memory of 4648	4056	rundll32.exe	80
PID 4056 wrote to memory of 4648	4056	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d09d894f0ad9a449d561ea1a3da30054d5ae0036786a9b54ff6604ab1f07a9ac.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4056
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d09d894f0ad9a449d561ea1a3da30054d5ae0036786a9b54ff6604ab1f07a9ac.dll,#1
  2⤵
  PID:4648