1dafa0a782c4a05d6c57aa5a9bd98079f8fbf32cd5eb58467ae1ace5ae313ed7

Analysis

max time kernel
90s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
18/09/2022, 22:28

Target

1dafa0a782c4a05d6c57aa5a9bd98079f8fbf32cd5eb58467ae1ace5ae313ed7.dll
Size

36KB
MD5

ab492e8b62d60326b3c4ca03709efe00
SHA1

c1d69a3051dc37db0d9edb5654fd36bd37a3c6e6
SHA256

1dafa0a782c4a05d6c57aa5a9bd98079f8fbf32cd5eb58467ae1ace5ae313ed7
SHA512

9f2956e46444f5f963c1d7bb1c396db7cc7e636986e77bdf6bc682ede85130fca18d0b77f00f434b2f2c545c34ae5d1323fe77033edc3b7c5295ebe4f44b8982
SSDEEP

768:rWtf1lkAzsDbNNO+Ba0Z/7MQiSyCLvH/CODbhTR+6Q:w1lkwK3O4aW7MzSzLvKOhTR+6Q

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 1708	2060	rundll32.exe	80
PID 2060 wrote to memory of 1708	2060	rundll32.exe	80
PID 2060 wrote to memory of 1708	2060	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1dafa0a782c4a05d6c57aa5a9bd98079f8fbf32cd5eb58467ae1ace5ae313ed7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1dafa0a782c4a05d6c57aa5a9bd98079f8fbf32cd5eb58467ae1ace5ae313ed7.dll,#1
  2⤵
  PID:1708