2a2d8d3bf4498b322ac73b31ccb6c99a86274f9623af00877d51937c82d6ac58

Analysis

max time kernel
91s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 09:05

Target

2a2d8d3bf4498b322ac73b31ccb6c99a86274f9623af00877d51937c82d6ac58.dll
Size

57KB
MD5

801049f633022f55c8f7ce79853fac86
SHA1

772ff3e88282ac92791dea668bad40f2d5356655
SHA256

2a2d8d3bf4498b322ac73b31ccb6c99a86274f9623af00877d51937c82d6ac58
SHA512

320d09798c38eba76632795c3f09dd61b0f72f05b15a9e9e5f8e79061c1dab34f0e0a813935bfbfcfec8d0bd5c3e3918b63a7f9e1d8d2ffb84cc7a7373305d5e
SSDEEP

1536:EvDz08bQ9XPbmgBVC0Vcni4MXRkRXmhSy+mh1:qfW/HV/dR+XmhX+mh1

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4256 wrote to memory of 1040	4256	rundll32.exe	81
PID 4256 wrote to memory of 1040	4256	rundll32.exe	81
PID 4256 wrote to memory of 1040	4256	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2a2d8d3bf4498b322ac73b31ccb6c99a86274f9623af00877d51937c82d6ac58.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4256
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2a2d8d3bf4498b322ac73b31ccb6c99a86274f9623af00877d51937c82d6ac58.dll,#1
  2⤵
  PID:1040