9cf0e5ac4a4c0851a9d5264ed4c62a512b66df7617994db3f2d2ab3d1d7a70ec

Analysis

max time kernel
91s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 08:54

Target

9cf0e5ac4a4c0851a9d5264ed4c62a512b66df7617994db3f2d2ab3d1d7a70ec.dll
Size

11KB
MD5

2a304725b6eed080000339ebd417e9f7
SHA1

8368cc40f45ccceb003a45e788f152d1476e9a14
SHA256

9cf0e5ac4a4c0851a9d5264ed4c62a512b66df7617994db3f2d2ab3d1d7a70ec
SHA512

2844fd9179ac013bceae1bc1075643eef94ae82a08d0b9349b5502e45efbff09ce6a87fded4e0b215a761bdd993a2132612a72ec1b0a2679647cde90990aafce
SSDEEP

192:cUeniB1xmgfTpHeJTFoDZZPMRHgUG7/nXLUD3OrPn/jiZgl+QWZRt:3enimgfpeJE0xG7/nXOej+ZtBz

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 1140	2320	rundll32.exe	84
PID 2320 wrote to memory of 1140	2320	rundll32.exe	84
PID 2320 wrote to memory of 1140	2320	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9cf0e5ac4a4c0851a9d5264ed4c62a512b66df7617994db3f2d2ab3d1d7a70ec.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9cf0e5ac4a4c0851a9d5264ed4c62a512b66df7617994db3f2d2ab3d1d7a70ec.dll,#1
  2⤵
  PID:1140