ffdaa284c0f44157ee31a268b943cde690ba49633903a84658f22011a54f6d6b

Analysis

max time kernel
147s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2023, 11:26

Target

easy_Benign_ffdaa284c0f44157ee31a268b943cde690ba49633903a84658f22011a54f6d6b.dll
Size

8KB
MD5

e285ab377a1af4c5e7fd63ed63347c84
SHA1

f232263024b52ee767e767e24a4bd84d970d9334
SHA256

ffdaa284c0f44157ee31a268b943cde690ba49633903a84658f22011a54f6d6b
SHA512

d0480a0681fb78692e5e1aa6afa547b7a5226d59ec0f96b9e4acc7a7359d690a4e316957d98ef678630d52b2cc5f085f0f95c7e210e42027c315a85aa7f3408c
SSDEEP

96:yScqZfvaW27YWhzDpMxvLPFNlqEHxvaD9HDTN:EW27YWhhMx/PHx8N

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4060 wrote to memory of 2956	4060	rundll32.exe	85
PID 4060 wrote to memory of 2956	4060	rundll32.exe	85
PID 4060 wrote to memory of 2956	4060	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\easy_Benign_ffdaa284c0f44157ee31a268b943cde690ba49633903a84658f22011a54f6d6b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4060
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\easy_Benign_ffdaa284c0f44157ee31a268b943cde690ba49633903a84658f22011a54f6d6b.dll,#1
  2⤵
  PID:2956