aa1b516a546185f89b2da524bb593c51d4ebebbfb7bb83a7990e6da50df533a6

Analysis

max time kernel
90s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 18:48

Target

aa1b516a546185f89b2da524bb593c51d4ebebbfb7bb83a7990e6da50df533a6.dll
Size

148KB
MD5

246ee48e6365e7ca619c184a08fb2c40
SHA1

1f3a18648961d22836316e6275c9fc5c785ee405
SHA256

aa1b516a546185f89b2da524bb593c51d4ebebbfb7bb83a7990e6da50df533a6
SHA512

0f69fc9253889f6cf415ddc1660ea2483ea20354d642e7e9e4d1c93a2efe7390b20d452ca185cc98ed1d1793ec9dc31112ab3b6985c1fe99e8125ff219ba66ee
SSDEEP

3072:xHNIjFagzS+8NDdeA9DQ2G/O2pB+zcZbvdpe7VNS:/IjoE8bP0NpBw0FpeR

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 3956	2448	rundll32.exe	82
PID 2448 wrote to memory of 3956	2448	rundll32.exe	82
PID 2448 wrote to memory of 3956	2448	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\aa1b516a546185f89b2da524bb593c51d4ebebbfb7bb83a7990e6da50df533a6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\aa1b516a546185f89b2da524bb593c51d4ebebbfb7bb83a7990e6da50df533a6.dll,#1
  2⤵
  PID:3956