aa47670680f6e409eeb6c5a93861be6ea5acf3fdbace494d683518569bdee4a4

Analysis

max time kernel
144s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2022, 11:13

Target

aa47670680f6e409eeb6c5a93861be6ea5acf3fdbace494d683518569bdee4a4.dll
Size

18KB
MD5

05a7ae3a05b2e11c092b807c0f3dcc40
SHA1

4c4df5e6c59cf08a4928cfb3ac5f4893b06aa123
SHA256

aa47670680f6e409eeb6c5a93861be6ea5acf3fdbace494d683518569bdee4a4
SHA512

f4ad901a6214781b5b2b1d8bd538ffdc5cac94be2374bc4d29400b5254c8d870afaa03d63e95fc66fdc0eb4519cfe8b3f196bda5a177e36bd8b6ddca68ec5ab7
SSDEEP

384:z/rDKFb+tnPWjtLf8zvr/wBQAjxWro0viKDSc:zPqatnPWjtLfYYOAFWrdvnDn

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4736 wrote to memory of 1512	4736	rundll32.exe	79
PID 4736 wrote to memory of 1512	4736	rundll32.exe	79
PID 4736 wrote to memory of 1512	4736	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\aa47670680f6e409eeb6c5a93861be6ea5acf3fdbace494d683518569bdee4a4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\aa47670680f6e409eeb6c5a93861be6ea5acf3fdbace494d683518569bdee4a4.dll,#1
  2⤵
  PID:1512