71af3b1eb3b6593a5c01b0582c07a8ba6d92a780d1c0b9ef02bea1ad008d98ee

Analysis

max time kernel
142s
max time network
170s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
01-11-2023 08:35

Target

nwl415x2fc-cleaned.dll
Size

260KB
MD5

7946926dd10e953e5056515a20954a73
SHA1

6090eec59234bd0237abef6b222329b7739b2e43
SHA256

71af3b1eb3b6593a5c01b0582c07a8ba6d92a780d1c0b9ef02bea1ad008d98ee
SHA512

823c2f6c7d0ab55dc72c70feee9776c0a1cac60d74aaa12e13fc173ba58847ae8439af76dfd2a9ddbadd2091ad658200ce36a119d4ae1ae5124e1e435ff3a912
SSDEEP

3072:0TBncFWn1GG7bnDOlQGJ1axJO3d0NBMFh3wXrnWm6ObcgOXyMZbv4uEnk0ZOuK9V:0TpGG7jtO3dmuhAXr9bLOXXZbgp1

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3884 wrote to memory of 1428	3884	rundll32.exe	35
PID 3884 wrote to memory of 1428	3884	rundll32.exe	35
PID 3884 wrote to memory of 1428	3884	rundll32.exe	35

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\nwl415x2fc-cleaned.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3884
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\nwl415x2fc-cleaned.dll,#1
  2⤵
  PID:1428