aa2d7cba0b5b9e7a79254629bba52bdd5722d81ad1585291ff51bbb02d18a540

Analysis

max time kernel
111s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 03:55

Target

aa2d7cba0b5b9e7a79254629bba52bdd5722d81ad1585291ff51bbb02d18a540.dll
Size

52KB
MD5

3c2d52790ed2fae8be3e085d6d6a1c3f
SHA1

d379340250b5d4bea9277ae15e668473ae4812a5
SHA256

aa2d7cba0b5b9e7a79254629bba52bdd5722d81ad1585291ff51bbb02d18a540
SHA512

8823b07668654de4efa1b9ec5af6889568c5ffaa65a96cf56a2b6b5351ab850175f6bd693394ca0689c93ece41e1f067df0b190eb354ebaa146544fe12a02c5e
SSDEEP

768:op1VqVQwL6diO9DnPHjkS7FoOQegc9EGLdNciIYJVaFQy+veoNXkVdoVxXQF9TP7:ob8Vwn/kS7DQedx9yup96GiF9/P

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4540 wrote to memory of 2864	4540	rundll32.exe	23
PID 4540 wrote to memory of 2864	4540	rundll32.exe	23
PID 4540 wrote to memory of 2864	4540	rundll32.exe	23

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\aa2d7cba0b5b9e7a79254629bba52bdd5722d81ad1585291ff51bbb02d18a540.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4540
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\aa2d7cba0b5b9e7a79254629bba52bdd5722d81ad1585291ff51bbb02d18a540.dll,#1
  2⤵
  PID:2864

memory/2864-136-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download