5aa828a3c902d3cba9badffea457492a15d74177b6a6290651437fb275aeaa3d

Analysis

max time kernel
91s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
01/10/2022, 17:51

Target

5aa828a3c902d3cba9badffea457492a15d74177b6a6290651437fb275aeaa3d.dll
Size

98KB
MD5

04c2c7b87b9a9315d86ac6cdd369e790
SHA1

c8b04747a833a9a3d4364ddf9b0c6dbf51828d34
SHA256

5aa828a3c902d3cba9badffea457492a15d74177b6a6290651437fb275aeaa3d
SHA512

8a3684201e3d566fcaa8b4f1fb7e0e2a8c3268cfa2fcdddf43afd547518417d05e2c2285672cd5d15ea270488d8251978e137a537e8cfed0e2472c02ac96cfa9
SSDEEP

1536:vzYcGYquNQUXaZx+el1w4oDcR3/unZhcXWwiskd1O7x+WmhiLPGHGqTLO23:lQuaUuDuDcRWH0oskyUEDpql

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4844 wrote to memory of 2160	4844	rundll32.exe	83
PID 4844 wrote to memory of 2160	4844	rundll32.exe	83
PID 4844 wrote to memory of 2160	4844	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5aa828a3c902d3cba9badffea457492a15d74177b6a6290651437fb275aeaa3d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4844
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5aa828a3c902d3cba9badffea457492a15d74177b6a6290651437fb275aeaa3d.dll,#1
  2⤵
  PID:2160

memory/2160-133-0x00000000611F0000-0x000000006120D000-memory.dmp

Filesize
116KB

Download