ff81e3e22c834ba422b96eeef2bde762196158b80ddb2e6e706dc85039578bf1

Analysis

max time kernel
183s
max time network
194s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 17:55

Target

ff81e3e22c834ba422b96eeef2bde762196158b80ddb2e6e706dc85039578bf1.dll
Size

338KB
MD5

0d5f88d2107056ada1ba513891f7f91d
SHA1

3f5d7b43340ee9018b9517338eae7184ee485465
SHA256

ff81e3e22c834ba422b96eeef2bde762196158b80ddb2e6e706dc85039578bf1
SHA512

e8bb8bb9043190548a10b6525c2302a7b28bd1590edea2b16a1c4adacc31696bd74053eeaa4ffdf5017416f2aef1f54aeebb6178ae6c5a933639501bed632f57
SSDEEP

6144:E80W354Y8wjhPzEvn/J3oa4FtDTtUhOSsSiQdTBov9f:v54Y8OPcutHSOSsSfdTo

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4952 wrote to memory of 4708	4952	rundll32.exe	81
PID 4952 wrote to memory of 4708	4952	rundll32.exe	81
PID 4952 wrote to memory of 4708	4952	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ff81e3e22c834ba422b96eeef2bde762196158b80ddb2e6e706dc85039578bf1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ff81e3e22c834ba422b96eeef2bde762196158b80ddb2e6e706dc85039578bf1.dll,#1
  2⤵
  PID:4708