9f55b06764de138d039549ff8fb02f65caa5bf54f55b5d4f9dd205013ff29fcd

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 00:59

Target

9f55b06764de138d039549ff8fb02f65caa5bf54f55b5d4f9dd205013ff29fcd.dll
Size

347KB
MD5

5928c5dc4d6f8970bd009b3e13b9db08
SHA1

25480a193ff822d3037b4794b1ecb248dc5c6c10
SHA256

9f55b06764de138d039549ff8fb02f65caa5bf54f55b5d4f9dd205013ff29fcd
SHA512

ee845415d1d2729e7404b7aa1364e1461d291c75acdf0e9a4918df336c219388b4b511b144bd400e45c5b5bd6c4ce4bfa48578ee43a2fba7a928169a4df9f985
SSDEEP

6144:LmWYIYBnBkQdnDo3Ki+0odhAbr1w7nOjvHSpbLmOwvSWTB4PlJR5H7K:LmWY5Bn2QG3BFod2bZ8DOSWT+vm

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 820 wrote to memory of 3724	820	rundll32.exe	82
PID 820 wrote to memory of 3724	820	rundll32.exe	82
PID 820 wrote to memory of 3724	820	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9f55b06764de138d039549ff8fb02f65caa5bf54f55b5d4f9dd205013ff29fcd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:820
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9f55b06764de138d039549ff8fb02f65caa5bf54f55b5d4f9dd205013ff29fcd.dll,#1
  2⤵
  PID:3724