e9c331e5e9541c9aaab843e7227f2fee1778840e416c585ec4184cb29cd64264

Analysis

max time kernel
146s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
18-05-2023 20:08

Target

e9c331e5e9541c9aaab843e7227f2fee1778840e416c585ec4184cb29cd64264.dll
Size

288KB
MD5

54f3ce95eb56b1f4861041ca4b2173fb
SHA1

797605d59553d5426fbca42f37b282cc03b0e3f3
SHA256

e9c331e5e9541c9aaab843e7227f2fee1778840e416c585ec4184cb29cd64264
SHA512

20baa461b47185b71caf41c74af3e4f3285e3af33f39d60c3823ba3e63ccbb77b4c064552b932f155561029d035f98465b866a81bf005f9c965ed062e172f26b
SSDEEP

3072:cBiYmO/Kvrg9fAINn3BURX2cNQoPqRDCnopdVJJTffVpzhUDJ351OfctB2UXeI:cBiYmO/Kvrg9fPxUwXmqRUopdv0qsxd

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2240 wrote to memory of 1852	2240	rundll32.exe	rundll32.exe
PID 2240 wrote to memory of 1852	2240	rundll32.exe	rundll32.exe
PID 2240 wrote to memory of 1852	2240	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e9c331e5e9541c9aaab843e7227f2fee1778840e416c585ec4184cb29cd64264.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2240

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e9c331e5e9541c9aaab843e7227f2fee1778840e416c585ec4184cb29cd64264.dll,#1
2⤵
PID:1852