9cc7166362874276ac17e2b17065111ab11440cd4d5ccdbcf2511eaf39dafef8

Analysis

max time kernel
92s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2024, 23:23

Target

9cc7166362874276ac17e2b17065111ab11440cd4d5ccdbcf2511eaf39dafef8.dll
Size

7KB
MD5

62d952c44b340486a3e86d4b71df4082
SHA1

e1a86e6e702b134f4d85c918071fd65f399263e2
SHA256

9cc7166362874276ac17e2b17065111ab11440cd4d5ccdbcf2511eaf39dafef8
SHA512

b0e560df90e31915f120eadc797c3c81a0cc37b2950552246aee8055ef704b89cc6200302eed2078caffaa38d3812bf50f889e10963e7283e4bf478c793b8b64
SSDEEP

96:wb4VHccYJUC/aFbz/j0OvaPrSd3cX5aXW:wUaJf/aFbP0Od2JaX

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1396 wrote to memory of 4856	1396	rundll32.exe	86
PID 1396 wrote to memory of 4856	1396	rundll32.exe	86
PID 1396 wrote to memory of 4856	1396	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9cc7166362874276ac17e2b17065111ab11440cd4d5ccdbcf2511eaf39dafef8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1396
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9cc7166362874276ac17e2b17065111ab11440cd4d5ccdbcf2511eaf39dafef8.dll,#1
  2⤵
  PID:4856