a1a39591f7ef885c93e69d1176f9660acbd6216272746c6815ef8cafa6276fa8

Analysis

max time kernel
157s
max time network
192s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06-11-2022 13:26

Target

a1a39591f7ef885c93e69d1176f9660acbd6216272746c6815ef8cafa6276fa8.dll
Size

48KB
MD5

2672008a90525b4ef1409aed43265a8c
SHA1

02b5f36c03ad7f14df8077cfea1bf4e2faf51785
SHA256

a1a39591f7ef885c93e69d1176f9660acbd6216272746c6815ef8cafa6276fa8
SHA512

baba969bb4b03a300adeadac23646b8a87bb32ac1a3698e2ddd94cb0e2b6f223e78d6d1d4c0a91f60e81ec0767aea15e4b6532c7384d8d578e7a37dc9d585ca3
SSDEEP

768:/S5ySUJ6kMtVBi8oJLng2QrMIt+bL3u0pxryBuXo9T:/SsSUJ6kMZqu2QrNOPpxGco

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4440 wrote to memory of 3060	4440	rundll32.exe	79
PID 4440 wrote to memory of 3060	4440	rundll32.exe	79
PID 4440 wrote to memory of 3060	4440	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a1a39591f7ef885c93e69d1176f9660acbd6216272746c6815ef8cafa6276fa8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4440
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a1a39591f7ef885c93e69d1176f9660acbd6216272746c6815ef8cafa6276fa8.dll,#1
  2⤵
  PID:3060

memory/3060-133-0x00000000023C0000-0x0000000002496000-memory.dmp

Filesize
856KB

Download
memory/3060-134-0x00000000023C0000-0x0000000002496000-memory.dmp

Filesize
856KB

Download