9ee94188eca4662d84e2607e068ae0f3f9e957ab727ff70ffb6040690dc19c45

Analysis

max time kernel
41s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 00:45

Target

9ee94188eca4662d84e2607e068ae0f3f9e957ab727ff70ffb6040690dc19c45.dll
Size

5.3MB
MD5

b36d4d38453a47de8ebfe04ec5ed1a3f
SHA1

368889f3969e72fe436375b9b59bfc2aa91992f1
SHA256

9ee94188eca4662d84e2607e068ae0f3f9e957ab727ff70ffb6040690dc19c45
SHA512

b3190ad208cd28269482780eda29e9be9de1b7573c2fba9a2712c59277059bfab0fb2447d6fc7bb62ed657a3c599913015545be3e7b44585ddf8f9bb1d64467d
SSDEEP

98304:J8PLVkv6ENYYRSUGCLn5ZHGXu49be9amNV4zuxSiwab8+lau:OPLCv6EVSUGCLn5hGXu49691Siwa/

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 2200	1880	rundll32.exe	81
PID 1880 wrote to memory of 2200	1880	rundll32.exe	81
PID 1880 wrote to memory of 2200	1880	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9ee94188eca4662d84e2607e068ae0f3f9e957ab727ff70ffb6040690dc19c45.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9ee94188eca4662d84e2607e068ae0f3f9e957ab727ff70ffb6040690dc19c45.dll,#1
  2⤵
  PID:2200