8efa2e922e60a1b14be30990d9c62821898d119923b1f2893af9276424d11eb3

Analysis

max time kernel
119s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28/10/2022, 18:34

Target

8efa2e922e60a1b14be30990d9c62821898d119923b1f2893af9276424d11eb3.dll
Size

6KB
MD5

0aacbbd96e56f35d0b920ff8cb567c20
SHA1

65f52981d46ae67a380707653cdb0fb614b87eb5
SHA256

8efa2e922e60a1b14be30990d9c62821898d119923b1f2893af9276424d11eb3
SHA512

cd5626118f71fd27e766c2cdd9d5352277b79de09eb55ce408814c12dc6d8e8893b8ef5a8364bf1c25bfaa8b2c8184f8388eedae8ff6fd5894eb06c44eb07889
SSDEEP

96:Ts1Wnnnynnnnnnnn6nnann7nnXnnbnnKniROoqUFjdNOb9FbbbXHt7hZEvHHHE1e:YXN7FnYHNh2vHHHE0

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5028 wrote to memory of 4972	5028	rundll32.exe	82
PID 5028 wrote to memory of 4972	5028	rundll32.exe	82
PID 5028 wrote to memory of 4972	5028	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8efa2e922e60a1b14be30990d9c62821898d119923b1f2893af9276424d11eb3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8efa2e922e60a1b14be30990d9c62821898d119923b1f2893af9276424d11eb3.dll,#1
  2⤵
  PID:4972