aea6d3ce00ef4afcd389f4e79fda13d7810a77eda84cbe31f3e6e03ae304795b

Analysis

max time kernel
91s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2022, 09:18

Target

aea6d3ce00ef4afcd389f4e79fda13d7810a77eda84cbe31f3e6e03ae304795b.dll
Size

171KB
MD5

57baa971b4bd88f4dc44297ac774cbb7
SHA1

af7d5b538bdfdbedb707d0b7a103a5f905d6f429
SHA256

aea6d3ce00ef4afcd389f4e79fda13d7810a77eda84cbe31f3e6e03ae304795b
SHA512

f8a589e0ffa0a1f497842ccbdbf6b778d8c98b904974e2f7198dad4c444e81a79d6ef978076f4aeba0f851837a5f8a79fa4b3210a19878c36189cb4260369836
SSDEEP

3072:XADzkVIQF7+v+/eVNGRR+gprl64Vo1L3Uc:XADoZ+vFqJldVo1X

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3956 wrote to memory of 2820	3956	rundll32.exe	81
PID 3956 wrote to memory of 2820	3956	rundll32.exe	81
PID 3956 wrote to memory of 2820	3956	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\aea6d3ce00ef4afcd389f4e79fda13d7810a77eda84cbe31f3e6e03ae304795b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3956
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\aea6d3ce00ef4afcd389f4e79fda13d7810a77eda84cbe31f3e6e03ae304795b.dll,#1
  2⤵
  PID:2820

memory/2820-133-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download