f89f202c61e0fd863020f54dd623bf4387071688c5e540461f71f8d9ed015a3d

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14/02/2024, 03:20

Target

9a9f950f9abae011bd7ff06b45ffe227.dll
Size

8KB
MD5

9a9f950f9abae011bd7ff06b45ffe227
SHA1

02822ba60403bcefb8743ccd0f6e5180ab5f07eb
SHA256

f89f202c61e0fd863020f54dd623bf4387071688c5e540461f71f8d9ed015a3d
SHA512

4468dcb990b4ea8bd4393820ce3c969375b2ba5d6f2c939101eb31e1cf7e6437ad3070d11af8316b16563d28fb5791e083b0e300dce1856c748590a1eccbef4a
SSDEEP

96:roWUfqxqxcLAtWFDSVE2h2drwkqNUigi2S+BM72Wdi/Idtu:uxcyUuVE2h2a7fF2Q72ywku

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1820 wrote to memory of 1588	1820	rundll32.exe	84
PID 1820 wrote to memory of 1588	1820	rundll32.exe	84
PID 1820 wrote to memory of 1588	1820	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9a9f950f9abae011bd7ff06b45ffe227.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9a9f950f9abae011bd7ff06b45ffe227.dll,#1
  2⤵
  PID:1588