9f6e9ae57f0c5ac17b4661d2034e421c8270299fc0596eadcec6bbe3c5b9b425

Analysis

max time kernel
145s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 20:35

Target

9f6e9ae57f0c5ac17b4661d2034e421c8270299fc0596eadcec6bbe3c5b9b425.dll
Size

63KB
MD5

5c662eeefa70b4daabd5068eaecdf880
SHA1

ff675042ee4578974836aff42e851e5b98d7e2fc
SHA256

9f6e9ae57f0c5ac17b4661d2034e421c8270299fc0596eadcec6bbe3c5b9b425
SHA512

e9bec3be28cf3cc3975029d40e2a9d210baeb9826f21abb2d032814f1010c2daa93d0cdec2cbb6751f969208c06abab7bb5fd7d99cdb73a29db2b99bbb51ac08
SSDEEP

1536:EGA1Pf37qhx6DbzcSHcsT9wJS9xNsxjV0fy5BpZi5Yfn5Txad:EGA1Pj0s3cw3xwJsxCxaynpUATy

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3416 wrote to memory of 4776	3416	rundll32.exe	81
PID 3416 wrote to memory of 4776	3416	rundll32.exe	81
PID 3416 wrote to memory of 4776	3416	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9f6e9ae57f0c5ac17b4661d2034e421c8270299fc0596eadcec6bbe3c5b9b425.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3416
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9f6e9ae57f0c5ac17b4661d2034e421c8270299fc0596eadcec6bbe3c5b9b425.dll,#1
  2⤵
  PID:4776