a27780d607522aee4c0f69e90d127eb2e352f6650a095e6a5a485bf91c67f9bf

Analysis

max time kernel
6s
max time network
4s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2022, 21:20

Target

a27780d607522aee4c0f69e90d127eb2e352f6650a095e6a5a485bf91c67f9bf.dll
Size

6KB
MD5

0f45bf7a173ee47b1523b6d2eb56c4b0
SHA1

4c35f1d9c934dfeae6bc0b04c41c57aafea33244
SHA256

a27780d607522aee4c0f69e90d127eb2e352f6650a095e6a5a485bf91c67f9bf
SHA512

6ab39c4b757a4f7421f50bac758ecec957abe4b59d327efedbe45b4e490366caa5103396ce57eba71eb2a2968c7dcdb01853a75d8560f28d549f4f248b2ce419
SSDEEP

96:nI2RrUeqYEIsUxkxkHQFmxIhZ5b2Hfru7l:XR4eda2wK/

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 1564	1152	rundll32.exe	75
PID 1152 wrote to memory of 1564	1152	rundll32.exe	75
PID 1152 wrote to memory of 1564	1152	rundll32.exe	75

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a27780d607522aee4c0f69e90d127eb2e352f6650a095e6a5a485bf91c67f9bf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a27780d607522aee4c0f69e90d127eb2e352f6650a095e6a5a485bf91c67f9bf.dll,#1
  2⤵
  PID:1564