b9a8a72a725d8c2ed61fadcec2e4b5721ee8db6f2f9f1a190a91128e38914134

Analysis

max time kernel
90s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2022 17:15

Target

b9a8a72a725d8c2ed61fadcec2e4b5721ee8db6f2f9f1a190a91128e38914134.dll
Size

16KB
MD5

9df007ba65ceb5cc5cd2c5c01e5c25a2
SHA1

7b4339e78be96dbdd83197834cbdac28ad34768f
SHA256

b9a8a72a725d8c2ed61fadcec2e4b5721ee8db6f2f9f1a190a91128e38914134
SHA512

7aec552c86fe564856ed6aecbed32729d659c44dfb0db6acf5691d9fa3ee67ea9d1c7f39175c2012a90f8a688c01c7227a0bce6c048e31600e8c153b7c5fc386
SSDEEP

24:e1GSgDSEhTCglIB6SXvVmMPnTjvhBrDsqZ:SgDNllVImgTNBsG

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4876 wrote to memory of 528	4876	rundll32.exe	82
PID 4876 wrote to memory of 528	4876	rundll32.exe	82
PID 4876 wrote to memory of 528	4876	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b9a8a72a725d8c2ed61fadcec2e4b5721ee8db6f2f9f1a190a91128e38914134.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b9a8a72a725d8c2ed61fadcec2e4b5721ee8db6f2f9f1a190a91128e38914134.dll,#1
  2⤵
  PID:528