aa1928276ef766e811794b9286a2af8733bc0a6749f365068140fdd1bc6629a9

Analysis

max time kernel
96s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 21:30

Target

aa1928276ef766e811794b9286a2af8733bc0a6749f365068140fdd1bc6629a9.dll
Size

45KB
MD5

265a3c1a2a3cebb840230932ad749f56
SHA1

619a8754d1d2941cfb8ab3903e4c60f4a218216f
SHA256

aa1928276ef766e811794b9286a2af8733bc0a6749f365068140fdd1bc6629a9
SHA512

79765d10592a3106c1ac6e77e59ae4ca5643e417f72110a2a6233505c7feb774005f4da006324f86b383bdcbd7635af99086e80eec10baf714e29c22dc9d137b
SSDEEP

768:/C/96BnUVHmgOMtitTjxyNq5ewMwkjw5I9tGEADjMl6t:K/9oUC4WTQNqNfkjw2G4l

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4960 wrote to memory of 4940	4960	rundll32.exe	rundll32.exe
PID 4960 wrote to memory of 4940	4960	rundll32.exe	rundll32.exe
PID 4960 wrote to memory of 4940	4960	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\aa1928276ef766e811794b9286a2af8733bc0a6749f365068140fdd1bc6629a9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4960

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\aa1928276ef766e811794b9286a2af8733bc0a6749f365068140fdd1bc6629a9.dll,#1
2⤵
PID:4940

memory/4940-132-0x0000000000000000-mapping.dmp

Download
memory/4940-133-0x00000000001C0000-0x00000000001CF000-memory.dmp

Filesize
60KB

Download