04af983d953ca16476f5fc10c91d1e6f405cd984ec3922e85706a8bc76358d5c

Analysis

max time kernel
146s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
01/10/2022, 23:07

Target

04af983d953ca16476f5fc10c91d1e6f405cd984ec3922e85706a8bc76358d5c.dll
Size

32KB
MD5

0858c06f8bd846c43e9036bab201d850
SHA1

06ba95cbf36e8d17fe14fce52ce2b75241199eed
SHA256

04af983d953ca16476f5fc10c91d1e6f405cd984ec3922e85706a8bc76358d5c
SHA512

14d01c90aa3ac4afc9db3f594c5b377a3d078561b57785f5da1293c2332aa7ec078526355f4e5854864e9105c4e02cb983fd4081e6dbd440d7333d7783bc689b
SSDEEP

768:M8g/qQ5tk1RdmvWw7Ot+1kjWNqOZESRJGep:M8g/D5a7dmX7OtUuqRow

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 796 wrote to memory of 532	796	rundll32.exe	83
PID 796 wrote to memory of 532	796	rundll32.exe	83
PID 796 wrote to memory of 532	796	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\04af983d953ca16476f5fc10c91d1e6f405cd984ec3922e85706a8bc76358d5c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:796
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\04af983d953ca16476f5fc10c91d1e6f405cd984ec3922e85706a8bc76358d5c.dll,#1
  2⤵
  PID:532